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rf  i  rfVi  1 1  Widespread  Problems  with  Audit  Quality  Require 

Significant  Reform 

Highlights  of  GAO-09-468,  a  report  to  the 
Committee  on  Homeland  Security  and 
Governmental  Affairs,  U.S.  Senate 


Why  GAO  Did  This  Study 

The  Defense  Contract  Audit 
Agency  (DCAA)  under  the 
Department  of  Defense  (DOD) 
Comptroller  plays  a  critical  role  in 
contractor  oversight  by  providing 
auditing,  accounting,  and  financial 
advisory  services  in  connection 
with  DOD  and  other  federal  agency 
contracts  and  subcontracts. 

Last  year,  GAO  found  numerous 
problems  with  DCAA  audit  quality 
at  three  locations  in  California, 
including  the  failure  to  meet 
professional  auditing  standards. 
This  report  addresses  audit  quality 
issues  at  DCAA  offices  nationwide. 
GAO  was  asked  to  (1)  conduct  a 
broad  assessment  of  DCAA’s 
management  environment  and 
audit  quality  assurance  structure, 
(2)  evaluate  DCAA  actions  to  date 
to  correct  previously  identified 
problems,  and  (3)  identify  potential 
legislative  and  other  actions  for 
improving  DCAA  effectiveness  and 
independence.  To  achieve  these 
objectives,  GAO  analyzed  DCAA’s 
mission,  strategic  plan,  audit 
policies,  and  quahty  assurance 
program;  conducted  interviews; 
reviewed  selected  audits  at  DCAA 
offices;  and  analyzed  legislative 
and  other  actions. 


What  GAO  Recommends 


GAO  makes  17  recommendations 
to  DOD  and  the  DOD  Inspector 
General  (IG)  to  improve  DCAA’s 
management  environment,  audit 
quality,  and  oversight.  GAO  also 
discusses  matters  that  Congress 
should  consider  to  enhance  the 
effectiveness  and  independence  of 
DCAA  contract  audits.  DOD  and 
DOD  IG  generally  agreed  with 
GAO’s  recommendations, 
concurring  with  all  but  two. 

View  GAO-09-468  or  key  components. 

For  more  information,  contact  Gregory  Kutz  at 
(202)  512-6722  or  kutzg@gao.gov. 


What  GAO  Found 

GAO  fotmd  audit  quality  problems  at  DCAA  offices  nationwide,  including 
compromise  of  auditor  independence,  insufficient  audit  testing,  and 
inadequate  plarming  and  supervision.  GAO’s  conclusions  stem  from  a  review 
of  69  audit  assignments  supporting  contract  award  and  administrative 
decisions;  an  assessment  of  DCAA’s  audit  quality  assurance  structure,  which 
found  similar  audit  quality  problems  but  gave  satisfactory  ratings  to  deficient 
audits;  and  DCAA’s  rescission  of  80  problem  audit  reports.  The  rescinded 
audits  supported  decisions  on  pricing  and  contract  awards  and  impacted  the 
plarming  and  reliability  of  hundreds  of  other  DCAA  audits,  representing 
billions  of  dollars  in  DOD  expenditures.  GAO  findings  include  the  following. 
Selected  Details  of  Audits  GAO  Reviewed 


Contractor 

Audit 

Significant  case  study  issues 

Research  and 

development 

grantee 

Billing 

system 

• 

• 

DCAA  auditors  spent  530  hours  to  support  an  audit  of  a 
nonexistent  billing  system  and  reported  adequate  system  controls. 
Instead,  DCAA  should  have  relied  on  the  Single  Audit  Act  report  on 
the  grantee’s  cash  management  system.  DCAA  agrees. 

Combat 

systems 

Billing 

system 

• 

• 

• 

• 

This  was  a  new  system  and  therefore  high  risk,  but  auditors 
deleted  key  audit  steps  related  to  contractor  policies  and  internal 
controls  over  progress  payments  without  explanation. 

One  auditor  told  GAO  he  did  not  perform  detailed  tests  because 
“the  contractor  would  not  appreciate  it.” 

DCAA  allowed  the  contractor  7  months  to  address  6  significant 
deficiencies,  dropping  2  and  downgrading  the  other  4. 

DCAA  rescinded  this  audit  report  following  GAO's  review. 

Iraq 

reconstruction 

Accounting 

system 

• 

• 

• 

• 

Contractor  objected  to  draft  report,  which  included  8  significant 
deficiencies  in  the  accounting  system. 

Auditors  dropped  5  significant  deficiencies  and  downgraded  3 
others  to  suggestions  to  improve  without  performing  new  work. 
Supervisory  auditors  directed  audit  staff  to  delete  some  audit 
documents,  generate  others,  and  in  one  case,  copy  the  signature 
of  a  prior  supervisor  onto  new  documents  making  it  appear  that  the 
prior  supervisor  had  approved  a  revised  risk  assessment. 
Supervisory  auditor  who  approved  altered  documents  was  later 
promoted  to  western  region  quality  assurance  manager,  where  he 
served  as  quality  control  check  over  thousands  of  audits. 

Source:  GAO. 


GAO  found  DCAA’s  management  environment  and  quality  assurance  structure 
were  based  on  a  production-oriented  mission  that  put  DCAA  in  the  role  of 
facilitating  DOD  contracting  without  also  protecting  the  public  interest.  DCAA 
has  taken  several  positive  steps.  However,  DOD  and  DCAA  have  not  yet 
addressed  fundamental  weaknesses  in  DCAA’s  mission,  strategic  plan, 
metrics,  audit  approach,  and  human  capital  practices  that  had  a  detrimental 
effect  on  audit  quality. 

To  improve  DCAA  oversight,  the  DOD  Comptroller  requested  Defense 
Business  Board  and  “tiger  team”  reviews  and  established  a  DCAA  Oversight 
Committee.  In  addition,  in  the  short-term.  Congress  could  provide  DCAA  with 
certain  legislative  protections  and  authorities  similar  to  those  available  to  IGs. 
In  the  longer  term.  Congress  may  wish  to  consider  organizational  changes  to 
elevate  DCAA  to  a  component  agency  reporting  to  the  Deputy  Secretary  or  to 
establish  an  independent  govemmentwide  contract  audit  agency. 
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United  States  Government  Acconntability  Office 
Washington,  DC  20548 


September  23,  2009 

The  Honorable  Joseph  I.  Lieberman 
Chairman 

The  Honorable  Susan  M.  Collins 
Ranking  Member 

Committee  on  Homeland  Security  and 
Governmental  Affairs 
United  States  Senate 

The  Honorable  Claire  C.  McCaskill 
Chairman 

Subcommittee  on  Contracting  Oversight 
Committee  on  Homeland  Security  and 
Governmental  Affairs 
United  States  Senate 

This  report  addresses  audit  quality  problems  and  independence  issues  at 
the  Defense  Contract  Audit  Agency  (DCAA).  In  a  September  2008  hearing 
before  the  Committee,  we  testified^  that  DCAA  failed  to  meet  professional 
audit  standards  at  three  locations  in  California.  Specifically,  we  found  that 
the  audit  documentation  for  14  selected  audits  at  two  locations  did  not 
support  reported  opinions,  that  DCAA  supervisors  dropped  findings  and 
changed  audit  opinions  without  adequate  audit  evidence  for  their  changes, 
and  that  sufficient  audit  work  was  not  performed  to  support  audit 
opinions  and  conclusions.  Further,  we  found  that  contractor  officials  and 
the  Department  of  Defense  (DOD)  contracting  community  improperly 
influenced  the  audit  scope,  conclusions,  and  opinions  of  several  audits, 
including  forward  pricing  audits  at  a  third  location — a  serious 
independence  issue.  During  our  investigation,  DCAA  managers  took 
actions  against  their  staff  at  two  locations  that  served  to  intimidate 
auditors  and  create  an  abusive  work  environment.  For  example,  we 
learned  of  verbal  admonishments,  reassignments,  and  threats  of 
disciplinary  action  against  auditors  who  spoke  with  or  contacted  our 
investigators,  DOD  investigators,  or  DOD  contracting  officials. 


^  GAO,  DCAA  Audits:  Allegations  That  Certain  Audits  at  Three  Locations  Did  Not  Meet 
Professional  Standards  Were  Substantiated,  GAO-08-993T  (Washington,  D.C.:  Sept.  10, 
2008). 
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At  the  time  of  the  September  2008  hearing,  we  were  conducting  a  broad 
assessment  of  DCAA’s  management  environment  and  audit  quality 
assurance  structure  at  DCAA  offices  nationwide.  Given  the  evidence 
presented  at  this  hearing,  you  requested  that  we  expand  our  ongoing 
assessment.  This  report  therefore  presents  (1)  an  assessment  of  DCAA’s 
management  environment  and  quality  assurance  structure;  (2)  an  analysis 
of  DCAA’s  corrective  actions  in  response  to  our  July  2008  report,^  the 
Under  Secretary  of  Defense  (Comptroller/Chief  Financial  Officer)^  “tiger 
team”  review,'*  and  the  Defense  Business  Board  study; and  (3)  potential 
legislative  and  other  actions  that  could  improve  DCAA’s  effectiveness  and 
independence. 

To  assess  DCAA’s  overall  management  environment  and  quality  assurance 
structure,  we  analyzed  DCAA’s  mission  statement  and  strategic  plan, 
performance  metrics,  policies  and  audit  guidance,  and  system  of  quality 
control.  We  also  reviewed  audit  documentation  for  selected  audits  at 
certain  field  audit  offices  (FAO)  in  each  of  DCAA’s  five  regions  for 
compliance  with  generally  accepted  government  auditing  standards 
(GAGAS)®  and  other  applicable  standards.  We  selected  37  audits  of 
contractor  internal  control  systems  performed  by  seven  geographically 
disperse  DCAA  field  offices  within  the  five  DCAA  regions  during  fiscal 
years  2004  through  2006.^  These  were  the  most  recently  completed  fiscal 
years  at  the  time  we  initiated  our  audit.  Our  approach  focused  on  DCAA 
offices  that  reported  predominately  adequate,  or  “clean,”  opinions  on 
audits  of  contractor  internal  controls  over  cost  accounting,  billing,  and 


^  GAO,  DCAA  Audits:  Allegations  That  Certain  Audits  at  Three  Locations  Did  Not  Meet 
Professional  Standards  Were  Substantiated,  GAO-08-857  (Washington,  D.C.:  July  22,  2008). 

®  Hereafter  referred  to  as  the  DOD  Comptroller/CFO. 

^  Under  Secretary  of  Defense — Comptroller,  Memorandum  for  Director  Defense  Contract 
Audit  Agency,  Subject:  Implementation  of  Corrective  Actions,  (Washington,  D.C.:  Aug.  20, 
2008). 

®  Defense  Business  BocU'd,  Report  to  the  Secretary  of  Defense:  Independent  Review  Panel 
Report  on  the  Defense  Contract  Audit  Agency,  October  2008. 

®  GAO,  Generally  Accepted  Government  Auditing  Standards,  GAO-03-673G  (Washington, 
D.C.:  June  2003)  and  GAO-07-731G  (Washington,  D.C.:  July  2007). 

’’  In  the  case  of  follow-up  audits,  we  also  reviewed  the  documentation  for  the  previons  audit 
to  gain  an  understanding  of  the  scope  of  work  and  deficiencies  identified  in  the  prior  audit. 
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cost  estimating  systems  issued  in  fiscal  years  2005  and  2006/  We  selected 
DCAA  offices  that  report  predominately  adequate  opinions  on  contractor 
systems  and  related  internal  controls  because  contracting  officers  rely  on 
these  opinions  for  three  or  more  years  to  make  decisions  on  pricing  and 
contract  awards,  and  payment.  For  example,  audits  of  estimating  system 
controls  support  negotiation  of  fair  and  reasonable  prices.'’  Also,  the  FAR 
requires  contractors  to  have  an  adequate  accounting  system  prior  to  award 
of  a  cost-reimbursable  or  other  flexibly  priced  contract.  Billing  system 
internal  control  audit  results  support  decisions  to  authorize  contractors  to 
submit  invoices  directly  to  DOD  and  other  federal  agency  disbursing 
offices  for  payment  without  government  review.  “  In  addition,  DCAA  uses 
the  results  of  internal  control  audits  to  assess  risk  and  plan  the  nature, 
extent,  and  timing  of  tests  for  other  contractor  audits  and  other 
assignments.  When  a  contractor  has  received  an  adequate  opinion  on  its 
systems  and  related  controls,  DCAA  would  assess  the  risk  for  subsequent 
internal  control  and  cost-related  audits  as  low  and  would  perform  less 
testing  on  these  audits.  Although  our  selection  of  the  seven  offices  and  37 
internal  control  audits  was  not  statistical,  it  represented  about  9  percent  of 
the  total  76  DCAA  offices  that  issued  audit  reports  on  contractor  internal 
controls  and  nearly  18  percent  of  the  40  offices  that  issued  8  or  more 
reports  on  contractor  internal  controls  during  fiscal  year  2006.  Of  the  37 
internal  control  audits  we  reviewed,  32  reports  were  issued  with  adequate 
opinions  and  5  reports  were  issued  with  inadequate-in-part  opinions. 

At  the  same  seven  DCAA  field  offices,  we  selected  an  additional  32  paid 
voucher,  overpayment,  request  for  equitable  adjustment,  and  incurred  cost 
assignments  that  were  completed  during  fiscal  years  2004  through  2006  for 
review  of  supporting  documentation  to  determine  whether  DCAA  auditors 
were  identifying  and  reporting  contractor  overpayments  and  billing 


*  In  selecting  the  seven  DCAA  offices,  we  considered  a  2-year  history  of  internal  control 
audit  results.  The  seven  DCAA  offices  we  selected  reported  adequate  opinions  on  89 
percent  or  more  of  the  internal  control  reports  they  issued  during  fiscal  year  2006.  During 
fiscal  year  2005,  4  of  the  7  offices  reported  adequate  opinions  in  85  percent  or  more  of  the 
internal  control  reports  they  issued,  and  the  other  3  offices  issued  adequate  opinions  in  50 
to  69  percent  of  the  internal  control  audit  reports  they  issued. 

^  DCAA,  Contract  Audit  Manual  (CAM)  5-1202.  la  and  Defense  Federal  Acquisition 
Regulation  Supplement  (DFARS)  215.407-5. 

“  FAR  §§  16.104(h)  and  16.301-3(a)(l). 

“  FAR  §  42.101  and  DFARS  §  242.803. 
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errors.  In  total,  we  reviewed  69  DCAA  audits  and  cost-related 
assignments.^^  To  address  our  second  objective,  we  assessed  the  status 
and  analyzed  several  key  actions  that  DCAA  initiated  as  a  result  of  our 
earlier  investigation,  including  changes  in  performance  metrics  and  policy 
and  procedural  guidance,  as  well  as  DCAA  efforts  in  response  to  DOD 
Comptroller/CFO  and  Defense  Business  Board*''  recommendations.  To 
achieve  our  third  objective  to  identify  potential  legislative  and  other 
actions  that  could  improve  DCAA’s  effectiveness  and  independence,  we 
considered  DCAA’s  current  role  and  responsibilities;  the  framework  of 
statutory  authority  for  auditor  independence  in  the  Inspector  General  Act 
of  1978,  as  amended;*'*  best  practices  of  leading  organizations  that  have 
made  cultural  and  organizational  transformations;  our  past  work  on  DCAA 
organizational  alternatives;  GAGAS  criteria  for  auditor  integrity, 
objectivity,  and  independence;  and  GAO’s  Standards  for  Internal  Control 
In  the  Federal  Government*®  on  managerial  leadership  and  oversight. 

Throughout  our  audit,  we  met  with  the  DCAA  Director  and  DCAA 
headquarters  policy,  quality  assurance,  and  operations  officials  and  DCAA 
region  and  FAO  managers,  supervisors,  and  auditors.  We  also  met  with 
DOD  Office  of  Inspector  General  (OIG)  auditors  responsible  for  DCAA 
audit  oversight  and  DOD  OIG  hotline  office  staff.  We  conducted  this 
performance  audit  from  August  2006  through  December  2007,  at  which 
time  we  suspended  this  work  to  complete  our  investigation  of  hotline 
complaints  regarding  audits  performed  at  three  DCAA  field  offices.  We 
resumed  our  work  on  this  audit  in  October  2008  and  performed  additional 


*^  Contractor  overpayments  can  occur  as  a  result  of  errors  made  by  paying  offices,  such  as 
duplicate  payments  and  payments  in  excess  of  amounts  billed,  and  contractor  billing 
errors,  such  as  using  the  wrong  overhead  rate,  failing  to  withhold  designated  amounts  on 
progress  payments,  duplicate  billings,  or  billing  for  unallowable  cost.  Recoveries  of 
overpayments  can  be  accomplished  through  refunds,  subsequent  billing  offsets,  or  other 
adjustments  to  correct  billing  errors. 

*®  Although  we  selected  73  assignments  for  review,  two  internal  control  assignments  were 
assist  audits  and  two  cost  related  assignments  were  not  completed  assignments.  As  a 
result,  we  did  not  consider  these  four  eissignments  in  our  analysis,  and  we  discuss  the 
results  of  our  analysis  of  the  69  completed  assignments  that  we  reviewed. 

*“*  On  August  19,  2008,  at  the  request  of  the  DOD  Defense,  Comptroller,  the  Deputy 
Secretary  of  Defense  established  an  independent  review  panel  under  the  Defense  Business 
Board  (DBB)  to  review  DCAA  operations  and  make  recommendations  for  improvements. 

*®  Codified  in  an  appendix  to  Title  6  of  the  United  States  Code  (hereeifter  6  U.S.C.  App.). 

*®  GAO,  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIMD-00-21.3.1 
(Washington,  D.C.:  November  1999). 


Page  4 


GAO-09-468  DCAA  Audit  Environment 


work  through  mid-September  2009  to  evaluate  DCAA’s  quality  assurance 
program  during  fiscal  years  2007  and  2008,  assess  DCAA  corrective  actions 
on  identified  audit  quality  weaknesses,  and  consider  legislative  and 
organizational  placement  options.  During  our  assessment  of  DCAA 
corrective  actions  and  analysis  of  legislative  and  organizational  placement 
options  for  DCAA,  we  met  with  the  former  DOD  Comptroller/CFO  to 
discuss  plans  for  Office  of  Comptroller/CFO  and  Defense  Business  Board 
reviews,  and  we  continued  to  meet  with  and  obtain  information  from  the 
new  DOD  Comptroller/CFO  and  his  staff.  We  also  met  with  Comptroller’s 
new  DCAA  Oversight  Committee,  which  includes  the  Auditors  General  of 
the  Army,  the  Navy,  and  the  Air  Force;  the  DOD  Director  of  Defense 
Procurement  and  Acquisition  Policy;  and  the  DOD  Deputy  General 
Counsel  for  Acquisition.  We  obtained  DOD  and  DOD  OIG  comments  on  a 
draft  of  this  report.  DOD  and  DOD  IG  comments  are  summarized  in  the 
Agency  Comments  and  Our  Evaluation  section  of  this  report.  DOD 
comments  are  reprinted  in  appendix  IV  and  DOD  OIG  comments  are 
reprinted  in  appendix  V.  We  conducted  our  audit  in  accordance  with 
generally  accepted  government  auditing  standards.  Those  standards 
require  that  we  plan  and  perform  the  audit  to  obtain  sufficient,  appropriate 
evidence  to  provide  a  reasonable  basis  for  our  findings  and  conclusions 
based  on  our  audit  objectives.  We  believe  that  the  evidence  obtained 
provides  a  reasonable  basis  for  findings  and  conclusions  based  on  our 
audit  objectives.  We  performed  our  investigative  procedures  in 
accordance  with  quality  standards  set  forth  by  the  Council  of  the 
Inspectors  General  on  Integrity  and  Efficiency  (formerly  the  President’s 
Council  on  Integrity  and  Efficiency).  A  detailed  discussion  of  our 
objectives,  scope,  and  methodology  is  included  in  appendix  III. 


Background 


DOD  contract  management  continues  to  be  a  high-risk  area  for  the 
government.  With  hundreds  of  billions  of  taxpayer  dollars  at  stake, 
strong  controls  are  needed  to  provide  reasonable  assurance  that  contract 
funds  are  not  lost  to  fraud,  waste,  abuse,  and  mismanagement.  Downsizing 
of  contract  administration  personnel  during  the  1990s  coupled  with 
increased  contract  spending  since  2000  have  exacerbated  the  risks 
associated  with  DOD  contract  management.  Our  work  continues  to 


GAO,  High-Risk  Series:  An  Update,  GAO-09-271  (Washington,  D.C.:  January  2009). 
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identify  significant  problems  with  federal  agency  contract  payments'®  and 
contract  management. 

DCAA  is  charged  with  a  critical  role  in  DOD  contractor  oversight  by 
providing  auditing,  accounting,  and  financial  advisory  services  in 
connection  with  the  negotiation,  administration,  and  settlement  of 
contracts  and  subcontracts.  DCAA  also  performs  contract  audit  services 
and  payment  reviews  for  other  federal  agencies,  as  requested,  on  a  fee-for- 
service  basis.  DCAA  contract  audit  services  are  intended  to  be  a  key 
control  to  help  assure  that  prices  paid  by  the  government  for  needed 
goods  and  services  are  fair  and  reasonable  and  that  contractors  are 
charging  the  government  in  accordance  with  applicable  laws,  regulations 
(e.g..  Federal  Acquisition  Regulation  (FAR)  and  Defense  Federal 
Acquisition  Supplement  (DFARS),  standards  (e.g..  Cost  Accounting 
Standards  (CAS)),  and  contract  terms. 

DCAA  is  headed  by  a  director  who  reports  to  the  Under  Secretary  of 
Defense  (Comptroller/CFO).  DCAA’s  placement  provides  the  DOD 
Comptroller/CFO  with  access  to  financial  information  on  defense 
contracts  and  allows  the  Comptroller/CFO  to  make  this  information 
available  to  the  Secretary  and  Deputy  Secretary  of  Defense.  In  addition,  it 
permits  the  Comptroller/CFO  to  elevate  policy  issues  concerning  the 
scope  of  DCAA’s  authority  and  level  of  resources.  The  DCAA  Director  is 


GAO,  Global  War  on  Terrorism:  DOD  Needs  to  More  Accurately  Capture  and  Report  the 
Costs  of  Operation  Iraqi  Freedom  and  Operation  Enduring  Freedom,  GAO-09-302 
(Washington,  D.C.:  Mar.  17,  2009);  Centers  for  Medicare  and  Medicaid  Services:  Internal 
Control  Deficiencies  Resulted  in  Millions  of  Dollars  of  Questionable  Contract  Payments, 
GAO-08-54  (Washington,  D.C.:  Nov.  16,  2007);  Defense  Contract  Management:  DOD’s  Lack 
of  Adherence  to  Key  Contracting  Principles  on  Iraq  Oil  Contract  Put  Government 
Interests  at  Risk,  GAO-07-839  (Washington,  D.C.:  July  31,  2007);  Hanford  Waste  Treatment 
Plant:  Department  of  Energy  Needs  to  Strengthen  Controls  over  Contractor  Payments 
and  Project  Assets,  GAO-07-888  (Washington,  D.C.:  July  20,2007);  Iraq  Contract  Costs: 
DOD  Consideration  of  Defense  Contract  Audit  Agency’s  Findings,  GAO  06-1132 
(Washington,  D.C.  Sept.  25,  2006);  Department  of  Energy,  Office  of  Worker  Advocacy: 
Deficient  Controls  Led  to  Millions  of  Dollars  in  Improper  and  Questionable  Payments  to 
Contractors,  GAO-06-547  (Washington,  D.C.:  May  31,  2006);  and  Federal  Bureau  of 
Investigation:  Weak  Controls  over  Trilogy  Project  Led  to  Payment  of  Questionable 
Contractor  Costs  and  Missing  Assets,  GAO-06-306  (Washington,  D.C.:  Feb.  28,  2006). 

GAO,  Defense  Acquisitions:  Assessments  of  Selected  Weapon  Programs,  GAO-09-326SP 
(Washington,  D.C.:  Mar.  30,  2009);  Defense  Management:  Actions  Needed  to  Overcome 
Long-standing  Challenges  with  Weapon  Systems  Acquisition  and  Service  Contract 
Management,  GAO-09-362T  (Washington,  D.C.:  Feb.  11,  2009);  and  Defense  Acquisitions: 
DOD’s  Increased  Reliance  on  Service  Contractors  Exacerbates  Long-standing  Challenges, 
GAO-08-621T  (Washington,  D.C.:  Jan.  23,  2008). 
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responsible  for  day-to-day  management  of  DCAA,  development  of  strategic 
plans,  audit  guidance  and  procedures,  and  the  quality  of  DCAA’s  audit 
services.  DCAA’s  Contract  Audit  Manual  (CAM)^°  prescribes  the 
standards,  policies,  and  techniques  to  be  followed  by  DCAA  persormel  in 
conducting  contract  audits.  DCAA  emphasizes  and  supplements  CAM 
guidance  through  policy  memorandums  and  other  written  notices,  as  well 
as  through  training  and  oral  communications. 

The  IG  Act  gives  the  DOD  IG  broad  responsibilities  to  provide  policy 
direction  for  and  to  conduct,  supervise,  and  coordinate  audits  and 
investigations  in  DOD  and  in  contractor  operations,  if  warranted.  DOD  IG 
duties  pertaining  to  DCAA  include  (1)  providing  policy  direction  for  all 
DOD  audits;  (2)  investigating  fraud,  waste,  and  abuse  uncovered  as  a 
result  of  audits;  (3)  monitoring  and  evaluating  adherence  by  all  DOD 
auditors  to  audit  policies,  procedures,  and  standards;  and  (4)  requesting 
assistance  as  needed  from  other  auditors  in  DOD.  As  part  of  its  audit 
policy  and  oversight  responsibilities,  the  DOD  IG  reviews  DCAA’s  system 
of  audit  quality  control  on  a  3-year  basis  that  is  intended  to  meet  the 
requirements  under  GAGAS  for  a  peer  review. 


DCAA  History  and  Audits  of  military  contracts  can  be  traced  back  to  at  least  the  World  War  I 

Organizational  Structure  initially,  the  various  branches  of  the  military  had  their  own  contract 

audit  function  and  associated  instructions  and  accounting  rulings. 
Contractors  and  government  personnel  recognized  the  need  for 
consistency  in  both  contract  administration  and  audit.  The  Navy  and  the 
Army  Air  Corps  made  the  first  attempt  to  perform  joint  audits  in  1939.  By 
December  1942,  the  Navy,  the  Army  Air  Corps,  and  the  Ordnance 
Department  had  established  audit  coordination  committees  for  selected 
areas  where  plants  were  producing  different  items  under  contracts  for 
more  than  one  service.  On  June  18,  1952,  the  three  military  services  jointly 
issued  a  contract  audit  manual  that  later  became  the  DCAA  CAM. 

In  May  1962,  Secretary  of  Defense  Robert  S.  McNamara  instituted  “Project 
60”  to  examine  the  feasibility  of  centrally  managing  the  field  activities 


DCAA,  Contract  Audit  Manual  (CAM),  DCAAM  7640.1. 
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concerned  with  contract  administration  and  audit.  An  outcome  of  this 
study  was  the  decision  to  establish  a  single  contract  audit  capability  within 
DOD  and  DCAA  was  established  on  June  8,  1965.^^  At  that  time,  DCAA’s 
mission  to  perform  all  necessary  contract  audits  for  DOD  and  provide 
accounting  and  financial  advisory  services  regarding  contracts  and 
subcontracts  to  all  DOD  components  responsible  for  procurement  and 
contract  administration  was  established.  The  former  Deputy  Comptroller 
of  the  Air  Force  was  selected  as  the  DCAA  Director  and  the  former 
Director  of  Contract  Audit  for  the  Navy,  was  selected  as  the  Deputy 
Director.  DCAA  was  placed  under  management  control  of  the  Under 
Secretary  of  Defense  (Comptroller),  where  it  remains  today. 

DCAA  consists  of  a  headquarters  office  at  Fort  Belvoir,  Virginia,  and  six 
major  organizational  components — a  field  detachment  office,  which 
handles  audits  of  classified  contracting  activity,  and  five  regional  offices 
within  the  United  States.  The  regional  offices  manage  field  audit  offices 
(FAO),  which  are  identified  as  branch  offices,  resident  offices,  or 
suboffices.  Resident  offices  are  located  at  larger  contractor  facilities  in 
order  to  facilitate  DCAA  audit  work.  In  addition,  regional  office  directors 
can  establish  suboffices  as  extensions  of  FAOs  to  provide  contract  audit 
services  more  economically.  A  suboffice  depends  on  its  parent  FAO  for 
release  of  audit  reports  and  other  administrative  support.  In  total,  there 
are  more  than  300  FAOs  and  suboffices  throughout  the  United  States  and 
overseas.  During  fiscal  year  2008,  DCAA  employed  about  3,600  auditors  at 
more  than  300  FAOs  throughout  the  United  States,  Europe,  the  Middle 
East,  and  in  the  Pacific  to  perform  audits  and  provide  nonaudit  services  in 
support  of  contract  negotiations  related  to  approximately  10,000 
contractors. 


DCAA  Audit  and  Nonaudit  DCAA’s  mission  encompasses  both  audit  and  nonaudit  services  in  support 
Services  of  DOD  contracting  and  contract  payment  functions.  FAR  subpart  42.1, 

“Contract  Audit  Services,”  and  DOD  Directive  5105.36,  Defense  Contract 


Project  60  also  resulted  in  consolidation  of  the  military  services’  contract  management 
activities  under  the  Defense  Contract  Management  Agency  (DCMA),  formerly  the  Defense 
Contract  Management  Command  (DCMC)  within  the  Defense  Logistics  Agency.  On  March 
27,  2000,  DCMC  was  established  as  DCMA  under  the  authority  of  the  Under  Secretary  of 
Defense  (Acquisition,  Technology,  and  Logistics). 

DOD,  General  Plan:  Consolidation  of  Department  of  Defense  Contract  Audit  Activities 
into  the  Defense  Contract  Audit  Agency  17,  1965). 
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Audit  Agency  (DCAA),  establish  DCAA  as  the  department’s  contract  audit 
agency^^  and  set  forth  DCAA’s  responsibilities. 

FAR  42.101  prescribes  contract  audit  responsibilities  as  submitting 
information  and  advice  to  the  requesting  activity,  based  on  the  analysis  of 
contractor  financial  and  accounting  records  or  other  related  data  as  to  the 
acceptability  of  the  contractors’  incurred  and  estimated  costs;  reviewing 
the  financial  and  accoimting  aspects  of  contractor  cost  control  systems; 
and,  performing  other  analyses  and  reviews  that  require  access  to 
contractor  financial  and  accounting  records  supporting  proposed  and 
incurred  costs.  DOD  Directive  5150.36  lists  several  responsibilities  and 
functions  that  shall  be  performed  by  the  DCAA  Director,^'*  including: 

•  “Assist  in  achieving  the  objective  of  prudent  contracting  by  providing 
DOD  officials  responsible  for  procurement  and  contract 
administration^’^  with  financial  information  and  advice  on  proposed  or 
existing  contracts  and  contractors,  as  appropriate.” 

•  “Audit,  examine,  and/or  review  contractors’  and  subcontractors’ 
accounts,  records,  documents,  and  other  evidence;  systems  of  internal 
control;  [and]  accounting,  costing,  and  general  business  practices  and 
procedures;  to  the  extent  and  in  whatever  manner  is  considered 
necessary  to  permit  proper  performance  of  other  functions  . . ..”  These 
other  functions  cover  contract  audit  and  nonaudit  services.  In  addition, 
the  Directive  states  that  the  DCAA  Director  shall  perform  such  other 
functions  as  may  be  assigned  by  the  Secretary  and  Deputy  Secretary  of 
Defense  or  the  Under  Secretary  of  Defense  (Comptroher/CFO). 

•  “Approve,  suspend,  or  disapprove  costs  on  reimbursement  vouchers 
received  directly  from  contractors,  under  cost-type  contracts, 
transmitting  the  vouchers  to  the  cognizant  Disbursing  Officer.” 

DCAA  uses  the  term  audit  to  refer  to  a  variety  of  evaluations  of  various 
types  of  data.^®  In  fiscal  year  2008,  DCAA  reported  that  over  97  percent  of 
its  service  work  hours  were  spent  on  audits,  meaning  that  DCAA  has  opted 
to  provide  nearly  ah  of  its  services  to  the  contracting  and  finance 


DODD  5105.36,  paragraph  4.2,  reissued  on  February  28,  2002. 

^  DODD  5105.36,  paragraphs  5.1  through  5.14. 

Contract  administration  responsibilities  are  set  forth  in  FAR  Subparts  42.2  and  42.3. 
CAM  2-001. 
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communities  under  applicable  auditing  standards,  as  discussed  below. 
Table  1  lists  several  audit  and  nonaudit  services  provided  by  DCAA  during 
the  three  phases  of  the  contracting  process — pre-award,  contract 
administration,  and  close-out — and  cites  the  statutory  and  regulatory 
provisions  that  authorize  or  establish  the  need  to  have  DCAA  perform  the 
service.  DCAA  audits  also  support  the  contract  payment  process  both 
directly  and  indirectly.  For  example,  audits  of  contractor  incurred  cost 
claims  and  voucher  reviews  directly  support  the  contract  payment  process 
by  providing  the  information  necessary  to  certify  payment  of  claimed 
costs.  Other  audits  of  contractor  systems,  including  audits  of  contractor 
internal  controls,  CAS  compliance,  and  defective  pricing,  indirectly 
support  the  payment  process  by  providing  assurance  about  contractor 
controls  over  cost  accounting,  cost  estimating,  purchases,  and  billings  that 
the  agency  may  rely  upon  when  making  contract  decisions,  such  as 
determinations  of  reasonable  and  fair  prices  on  negotiated  contracts.  For 
example,  an  accounting  system  deemed  to  be  adequate  by  a  DCAA  audit 
permits  progress  payments  based  on  costs  to  be  made  without  further 
audit. 


Table  1 :  Examples  of  DCAA  Audit  and  Nonaudit  Services 

Payment  support 

Contract  phase  and 
assignment 

Audit  and  Nonaudit  services 

Contracting 

support 

Direct  Indirect 

Pre-award  phase: 

Accounting  system" 

Audit:  DCAA  determines  adequacy  of  the  contractor's  accounting 
system  prior  to  award  of  a  cost-reimbursabie  or  other  fiexibiy 
priced  contract.  FAR  §  16.301-3(a)(l). 

X 

X 

Contractor  accounting 
disciosure  statements 

Audit:  DCAA  reviews  the  contractor's  Disciosure  Statement  for 
adequacy  and  CAS  compiiance  and  determines  whether  the 
contractor's  Disciosure  Statement  is  current,  accurate,  and 
compiete.  DCAA  aiso  reviews  Disciosure  Statements  during  the 
post  award  phase  if  contractors  revise  them.  FAR  §§  30.202-6(c), 
30.202-7  and  30.601(c). 

X 

X 

Estimating  system  " 

Audit:  DCAA  determines  adequacy  of  contractor  estimating 
systems.  FAR  §  15.407-5  and  DEARS  §  252.215-7002(d),  (e). 

X 

X 

Disbursing  officers  are  authorized  to  make  payments  on  the  authority  of  a  voucher 
certified  by  an  authorized  certifying  officer,  who  is  responsible  for  the  legality,  accuracy, 
and  propriety  of  the  payment.  31  U.S.C.  §§  3326,  3621(a),  and  3528(a). 

FAR  §  32.603-4. 
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Payment  support 

Contract  phase  and 
assignment 

Audit  and  Nonaudit  services 

Contracting 

support 

Direct  Indirect 

Contract  price 
proposals  and  forward 
pricing  proposals" 

Audit:  DCAA  examines  contractor  records  to  ensure  that  cost  or 
pricing  data  is  accurate,  current,  and  complete  and  supports  the 
determination  of  fair  and  reasonable  prices.  10  U.S.C.  §§  2306a 
and  2313  (DOD)  and  41  U.S.C.  §  254d  (other  agencies):  FAR 
Subpart  15.4  (esp.  FAR  §  15.404-2(c))  and  §  52.215-2(c);  and 
DFARS  §  215.404-1. 

X 

X 

Financial  liaison 
advisory  services" 

Nonaudit:  DCAA  Director  establishes  and  maintains  liaison 
auditors  and  financial  advisors,  as  appropriate,  at  major  procuring 
and  contract  administration  offices.  These  services  are  also 
provided  during  the  post-award  phase,  as  needed.  DODD 

5105.36,  paras.  7.1.1  and  5.9. 

X 

X 

Post  award/administration  phase: 

Internal  control  system 
audits  (generally) 

Audit:  DCAA  reviews  the  financial  and  accounting  aspects  of  the 
contractor's  cost  control  systems,  including  the  contractor's 
internal  control  systems.  FAR  §  42.101(a)(3)  and  DFARS  § 
242.7501. 

X 

X 

Billing  system  audits" 

Audit:  DCAA  determines  adequacy  of  contractors'  billing  system 
controls  and  reviews  accuracy  of  paid  vouchers.  DCAA  uses  audit 
results  to  support  approval  of  contractors  to  participate  in  the 
direct-bill  program.  FAR  §  42.101  and  DFARS  §  42.803  (b)(i)(C). 

X 

X 

Purchasing  system 
review  b 

Audit:  DCAA  determines  adequacy  of  a  contractor's  or 
subcontractor's  purchasing  system.  FAR  Subpart 44.3. 

X 

X 

Progress  payments" 

Audit:  DCAA  verifies  amount  claimed,  determines  allowability  of 
contractor  requests  for  cost-based  progress  payments,  and 
determines  if  the  payment  will  result  in  undue  financial  risk  to  the 
government.  FAR  §§  32.503-3,  32.503-4,  and  52.232-16. 

X 

X 

Incurred  cost  claims" 

Audit:  DCAA  determines  acceptability  of  the  contractors'  claimed 
costs  incurred  and  submitted  by  contractors  for  reimbursement 
under  cost-reimbursable,  fixed-price  incentive,  and  other  types  of 
flexibly  priced  contracts  and  compliance  with  contract  terms,  FAR, 
and  CAS,  if  applicable.  FAR  §§  42.101,  42.803(b),  and  DFARS  § 
242.803. 

X 

X 

Billing  rates  and  final 
indirect  cost  rates" 

Audit:  DCAA  establishes  billing  rates  for  interim  indirect  costs  and 
final  indirect  cost  rates.  FAR  §§  42.704,  42.705  and  42.705-2  and 
DFARS  §  42.705-2. 

X 

X 

Defective  pricing" 

Audit:  DCAA  determines  the  amount  of  cost  adjustments  related 
to  defective  pricing.  See  above  authorities  to  audit  contractor  cost 
and  pricing  data  and  FAR  §  15.407-1. 

X 

X 

CAS  compliance" 

Audit:  DCAA  determines  contractor  and  subcontractor  compliance 
with  CAS  setforth  in  48  CFR  §  9903.201  and  determines  cost 
impacts  of  noncompliance.  FAR  §§  1.602-2,  30.202-7,  and 
30.601(C). 

X 

X 

Other  specially 
requested  services 

Audit  and  nonaudit  services:  DCAA  conducts  performance  audits 
and  other  audits  based  on  requests  from  DOD  components  and 
requests  from  other  federal  agencies.  DOD  Directive  5105.36, 

Sec.  5. 

X 

X 
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Payment  support 

Contract  phase  and 
assignment 

Audit  and  Nonaudit  services 

Contracting 

support 

Direct  Indirect 

Paid  voucher  reviews" 

Nonaudit  services:  DCAA  reviews  vouchers  after  payment  to 
support  continued  contractor  participation  in  the  direct  biii 
program.  CAM  6-1007.6;  FAR  §  42.803;  DFARS  §  242.803; 

DODD  5105.36,  paras.  5.4  and  5.5;  and  DOD  Financial 
Management  Regulation  (f  MR),  voi.  10,  ch.  10,  para.  100202. 

X 

X 

Approvai  of  vouchers 
prior  to  payment" 

Nonaudit:  DCAA  reviews  and  approves  contractor  interim 
vouchers  for  payment  and  suspends  payment  of  questionabie 
costs.  FAR  §  42.803;  DFARS  §  242.803(b)(i)(B);  DOD  Directive 
5105.36,  paras.  5.4  and  5.5;  and  DOD  FMR  voi.  10,  ch.  10,  para. 
100202. 

X 

X 

Overpayment  reviews" 

Non  audit  services:  At  the  request  of  the  contracting  officer,  DCAA 
reviews  contractor  data  to  identify  potentiai  contract 
overpayments.  FAR  §§  2.605,  52.216-7(g),  (h)2. 

X 

X 

Close-out/termination  phase: 

Contract  ciose-out 
procedures  and 
audits" 

Audit:  DCAA  reviews  finai  compietion  vouchers  and  the 
cumuiative  aiiowabie  cost  worksheet  and  may  review  contract 
ciosing  statements.  DFARS  §  242.803(b)(i)(D). 

X 

X 

Source:  GAO  analysis. 


"Indicates  DCAA  audit  and  nonaudit  services  covered  in  this  audit. 

‘indicates  types  of  audits  covered  in  our  prior  investigation  {GAO-08-857).  We  reviewed  progress 
payment  and  contract  ciose-out  audits  that  reiated  to  audits  in  our  eariier  investigation  or  this  audit 
where  the  auditors  considered  the  evidence  in  those  audits. 


Importance  of  Audits  in  DCAA  policy  states^'’  that  it  follows  GAGAS^“  when  conducting  audits. 

Accordance  with  GAGAS  These  standards  provide  a  framework  for  conducting  high  quality 

government  audits  and  attestation  engagements.  These  standards  also 
provide  guidelines  to  help  government  auditors  maintain  competence, 
integrity,  objectivity,  and  independence  in  their  work  and  require  that  they 
obtain  sufficient  evidence  to  support  audit  conclusions  and  opinions. 
When  auditors  are  required  to  follow  GAGAS  or  are  representing  to  others 
that  they  followed  GAGAS,  they  should  follow  all  applicable  GAGAS 
requirements  and  should  refer  to  compliance  with  GAGAS  in  the  auditor’s 
report. Most  DCAA  audits  are  performed  as  attestation  audits  under 
GAGAS.  For  attestation  audits,  GAGAS  incorporates  the  American 


CAM,  2-101.  Except  where  stated  otherwise  in  this  report,  various  types  of  evaluations 
entailing  different  levels  of  assurance  that  DCAA  refers  to  as  audits — such  as  examinations, 
attestations,  and  reviews — were  subject  to  GAGAS. 

^°GAO-03-673G,  §1.01,  and  GAO-07-731G,  §1.03. 

GAO-07-731G,  §  1.11. 
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Institute  of  Certified  Public  Accountants  (AICPA)  general  standard  on 
criteria,  and  the  field  work  and  reporting  standards  and  the  related 
Statements  on  Standards  for  Attestation  Engagements  (SSAE),  unless 
specifically  excluded  or  modified  by  GAGAS/^  DCAA  also  conducts 
performance  audits  upon  request.  This  report  addresses  DCAA  attestation 
audits  and  related  supporting  assignments. 

GAGAS  state  that  the  public  expects  auditors  to  observe  the  principles  of 
serving  the  public  interest  and  maintaining  the  highest  degree  of  integrity, 
objectivity,  and  independence  in  discharging  their  professional 
responsibilities.  Serving  the  public  interest  and  honoring  the  public  trust 
are  critical  when  performing  government  audits.  Auditors  increase  public 
confidence  when  they  conduct  their  work  with  an  attitude  that  is 
objective,  fact-based,  nonpartisan,  and  non-ideological  with  regard  to 
audited  entities  and  users  of  the  auditors’  reports.  Auditors  also  should  be 
intellectually  honest  and  free  of  conflicts  of  interest  in  discharging  their 
professional  responsibihties.^^  Management  of  the  audit  organization  sets 
the  tone  for  ethical  behavior  throughout  the  organization  by  maintaining 
an  ethical  culture,  clearly  communicating  acceptable  behavior  and 
expectations  to  each  employee  and  creating  an  environment  that 
reinforces  and  encourages  ethical  behavior  throughout  all  levels  of  the 
organization.  The  credibility  of  auditing  in  the  government  sector  is 
based  on  auditors’  objectivity  and  integrity  in  discharging  their 
professional  responsibilities.^^ 


GAO-03-673G,  §  6.01,  and  GAO-07-731G,  §  6.01. 
GAO-07-731G,  §§  2.06  through  2.10. 

^  GAO-07-731G,  §  2.01. 

^  GAO-07-731G,  §  2.10. 
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Nationwide  Audit 
Quality  Problems  Are 
Rooted  in  DCAAs 
Poor  Management 
Environment 


We  found  audit  quality  problems  at  DCAA  offices  nationwide,  as 
demonstrated  by  serious  quality  problems  in  the  69  audits  and  cost-related 
assignments  we  reviewed,  DCAA’s  ineffective  audit  quality  assurance 
program,  and  DCAA’s  rescission  of  80  audit  reports  in  response  to  our 
work.  Of  the  69  audits  and  cost-related  assignments  we  reviewed  for  this 
report,  65  exhibited  serious  GAGAS  or  other  deficiencies  similar  to  those 
found  in  our  prior  investigation,  including  compromise  of  auditor 
independence,  insufficient  audit  testing,  and  inadequate  planning  and 
supervision.  Although  not  as  serious,  the  remaining  four  audits  also  had 
GAGAS  compliance  problems.  The  69  audits  and  cost-related  assignments 
we  reviewed  included  43  audits  that  DCAA  reported  were  performed  in 
accordance  with  GAGAS  and  26  non-GAGAS  cost-related  assignments, 
including  10  overpayment  and  16  paid  voucher  assignments.  According  to 
DCAA  officials,  DCAA  rescinded  the  80  audit  reports  because  the  audit 
evidence  was  outdated,  insufficient,  or  inconsistent  with  reported 
conclusions  and  opinions  and  reliance  on  the  reports  for  contracting 
decisions  could  pose  a  problem.  Nearly  one  third  (24)  of  the  80  rescinded 
reports  relate  to  unsupported  opinions  on  contractor  internal  controls, 
which  were  used  as  the  basis  for  risk-assessments  and  planning  on 
subsequent  internal  control  and  cost-related  audits.  Other  rescinded 
reports  relate  to  CAS  compliance  and  contract  pricing  decisions.  Because 
the  conclusions  and  opinions  in  the  rescinded  reports  were  used  to  assess 
risk  in  planning  subsequent  audits,  they  impact  the  reliability  of  hundreds 
of  other  audits  and  contracting  decisions  covering  billions  of  dollars  in 
DOD  expenditures.  We  found  that  DCAA’s  focus  on  a  production-oriented 
mission  led  DCAA  management  to  establish  policies,  procedures,  and 
training  that  emphasized  performing  a  large  quantity  of  audits  to  support 
contracting  decisions  over  audit  quality.  An  ineffective  quality  assurance 
structure  compounded  this  problem. 


Audit  Quality  Problems 
Found  in  All  Audits  GAO 
Reviewed 


We  found  audit  quality  problems,  including  GAGAS  compliance  problems, 
with  all  37  audits  of  contractor  internal  controls  and  the  4  incurred  cost 
and  the  2  request  for  equitable  adjustment  audits  we  reviewed  at  7  FAOs 
across  the  5  DCAA  regions  covered  in  this  audit.  In  addition,  none  of  the 
26  cost-related  assignments  we  reviewed  from  these  same  FAOs  included 
sufficient  testing  to  identify  contractor  overpayments  and  billing  errors. 


^  According  to  documentation  provided  by  DCAA  as  of  the  end  of  July  2009,  the  80 
rescinded  reports  include  62  reports  related  to  findings  in  our  July  2008  investigative  report 
and  18  reports  related  to  this  audit. 
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Internal  Control  Audits 


For  additional  details  on  our  analysis  of  these  DCAA  audits  and 
assignments,  including  narrative  case-studies,  see  appendixes  1  and  11. 

DCAA  performs  attestation  audits  of  contractors’  systems  for  cost 
accounting,  estimating,  and  billing  to  gather  evidence  to  express  an 
opinion  on  the  adequacy  of  the  contractor’s  systems  and  related  internal 
controls  for  compliance  with  applicable  laws  and  regulations  and  contract 
terms.  A  contractor  must  have  an  adequate  accounting  system  to  be 
awarded  a  government  cost-reimbursement  contract,  an  adequate  billing 
system  to  submit  invoices  for  payment  without  government  review,  and  an 
acceptable  estimating  system  to  support  a  contracting  officer’s  approval  of 
pricing  proposals.  A  secondary  objective  of  DCAA’s  audits  of  contractor 
systems  and  controls  is  to  determine  the  degree  of  reliance  that  can  be 
placed  on  the  contractor’s  internal  controls  as  a  basis  for  planning  the 
scope  of  other  related  audits.  For  example,  if  a  contractor  receives  an 
adequate  opinion  on  various  systems  control  audits,  auditors  assess  risk  as 
low  and  reduce  the  level  of  testing  on  subsequent  internal  control  and 
cost-related  audits,  including  audits  of  contractors’  annual  incurred  cost 
claims.  Although  the  reports  for  all  37  audits  of  contractor  internal 
controls  that  we  reviewed  stated  that  the  audits  were  performed  in 
accordance  with  GAGAS,  we  foimd  GAGAS  compliance  issues  with  all  of 
these  audits.  Examples  of  GAGAS  compliance  issues  we  foimd  included: 

Independence  issnes.  For  7  audits  we  reviewed,  DCAA  independence 
was  compromised  because  auditors  provided  material  nonaudit  services 
to  a  contractor  they  later  audited;  experienced  access  to  records  problems 
that  were  not  fully  resolved;  or  significantly  delayed  report  issuance  in 
order  to  allow  the  contractors  to  resolve  cited  deficiencies.  GAGAS  state 
that  auditors  should  be  free  from  influences  that  restrict  access  to  records 
or  improperly  modify  audit  scope. 

Insufficient  evidence.  We  found  that  33  of  the  37  internal  control  audits 
did  not  include  sufficient  testing  of  internal  controls  to  support  auditor 
conclusions  and  opinions.  GAGAS  for  examination-level  attestation 
engagements  require  that  sufficient  evidence  be  obtained  to  provide  a 
reasonable  basis  for  the  conclusion  that  is  expressed  in  the  report.^® 
However,  our  review  of  audit  documentation  often  found  that  only  two, 
three,  or  sometimes  five  transactions  were  tested  to  support  audit 


See  GAO-03-673G,  §  3.19,  and  GAO-07-731G,  §  3.10. 
GAO-03-673G,  §  6.04b. 
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conclusions,  and  the  audit  documentation  did  not  contain  a  justification 
for  the  small  sample  sizes  selected  for  testing.  For  internal  control  audits, 
which  are  relied  on  for  2  to  4  years  and  sometimes  longer,  the  auditors 
would  be  expected  to  test  a  representative  selection  of  transactions  across 
the  year  and  not  transactions  for  just  one  day,  one  month,  or  a  couple  of 
months.  For  many  controls,  the  procedures  performed  consisted  of 
documenting  the  auditors’  imderstanding  of  controls,  and  the  auditors  did 
not  test  the  effectiveness  of  the  implementation  and  operation  of  controls. 

Generally,  the  basis  for  an  auditor’s  determination  of  sufficient  testing 
should  include  (1)  an  adequate  risk  assessment,  taking  into  consideration 
any  auditor  alerts  arising  from  related  audits,  past  findings,  and  corrective 
actions;  (2)  the  contractor’s  overall  control  environment;  and  (3)  the 
nature  and  volume  of  transactions  and  associated  materiality  and  risk  of 
error.  For  example,  decisions  on  sufficient  testing  of  contractor  internal 
controls  would  include  consideration  of  the  number  and  types  of  contracts 
or  proposals;  the  nature,  dollar  amount,  and  volume  of  transactions;  and 
key  control  attributes  or  special  characteristics  of  the  transactions. 
Further,  a  representative  selection  would  include  a  representative  number 
of  transactions  from  a  population  of  transactions  representing  a 
reasonable  period  of  time,  in  order  for  test  results  to  support  conclusions 
and  opinions  on  the  overall  adequacy  of  the  contractor’s  systems  and 
effectiveness  of  the  related  controls.  For  example,  under  the  GAO/PCIE 
Financial  Audit  Manual, the  minimum  sample  size  for  an  attribute 
sample  of  a  control  would  be  45  items. 

Reporting  problems.  According  to  GAGAS,  audit  reports  should,  among 
other  matters,  identify  the  subject  matter  being  reported  and  the  criteria 
used  to  evaluate  the  subject  matter.  Criteria  identify  the  required  or 
desired  state  or  expectation  with  respect  to  the  program  or  operation  and 
provide  a  context  for  evaluating  evidence  and  understanding  the  findings. 
None  of  the  37  internal  control  audit  reports  we  reviewed  cited  specific 
criteria  used  in  individual  audits.  Instead,  the  reports  uniformly  used 
boilerplate  language  to  state  that  DCAA  audited  for  compliance  with  the 
“FAR,  CAS,  DFARS,  and  contract  terms.”  As  a  result  the  user  of  the  report 


AICPA  Statements  on  Auditing  Standards,  AU  350,  and  Audit  and  Accounting  Guide: 
Audit  Sampling,  §§  3.14,  3.29-3.34,  3.58,  and  3.61. 

GAO/PCIE,  Financial  Audit  Manual,  GAO-08-585G  (Washington,  D.C.:  July  2008). 

GAO-07-731G,  §  4.16. 
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does  not  know  the  specific  Federal  Acquisition  Regulation  (FAR),  Cost 
Accounting  Standards  (CAS),  or  contract  terms  used  as  criteria  to  test 
contractor  controls.  This  makes  it  difficult  for  users  of  the  reports  to 
determine  whether  a  particular  report  provides  the  level  of  assurance 
needed  to  make  contracting  decisions. 

The  lack  of  sufficient  support  for  the  audit  opinions  on  33  of  the  37 
internal  control  audits  we  reviewed  rendered  them  unreliable  for  decision 
making  on  contract  awards,  direct  billing  privileges,  the  reliability  of  cost 
estimates,  and  reported  direct  cost  and  indirect  cost  rates.  For  example, 
the  FAR  requires'*^  government  contracting  officers  to  determine  the 
adequacy  of  a  contractor’s  accounting  system  before  awarding  a  cost- 
reimbursement  contract.  Of  the  9  audits  of  contractor  accounting  system 
internal  controls  that  we  reviewed,  only  two  of  the  audits  included 
sufficient  testing  to  support  DCAA’s  audit  opinion  that  internal  controls 
over  the  contractors’  accounting  systems  were  adequate.  In  addition,  none 
of  the  20  audits  of  contractor  billing  system  internal  controls  we  reviewed 
contained  sufficient  testing  of  controls  to  support  the  reported  opinions. 
Adequate  opinions  on  billing  system  audits  are  the  basis  for  DCAA 
decisions  to  approve  contractors  for  the  direct  bill  program,  whereby 
contractors  submit  invoices  directly  to  a  government  disbursing  office 
without  prior  review.  Four  of  the  6  audits  of  contractor  estimating 
system  controls  that  we  reviewed  did  not  include  sufficient  testing  to 
support  the  reported  opinions.  DOD  requires^  that  large  contractors  have 
acceptable  estimating  systems.  Opinions  on  contractor  estimating  systems 
support  DCAA  decisions  on  the  extent  of  testing  performed  on  contract 
proposals.  Neither  of  the  two  internal  control  audits  of  contractor  indirect 
and  other  direct  costs  we  reviewed  included  sufficient  testing  to  support 
reported  opinions.  As  shown  in  figure  1,  at  the  time  these  audits  were 
performed,  DCAA  policy  guidance  provided  for  three  categories  of 
opinions  on  internal  control  audits.  This  policy  provided  for  different 
opinions  and  criteria  forjudging  them  based  on  the  severity  of  the 
problems  identified.  Professional  standards  have  long  recognized  different 
levels  of  severity  with  regard  to  reporting  deficiencies  and  material 
weaknesses  in  internal  controls. 


FAR  §§  16.104(h)  and  16.301-3(a)(l). 

FAR  §  42.101  and  DFARS  §  242.803(b)(i)CC). 
DFARS  §  216.407-5-70;  see  FAR  §  15.407-6. 
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Figure  1 :  DCAA  Opinions  on  Contractor  Internal  Control  Systems  Audits 


Risk  DCAA  opinion 


Criteria 


Resuitant  actions 


A  Adequate 

Lo  V 


hich 


7 


Inadequate 


No  significant 
deficiencies  were 
identified  in  the  audit 


Scope  of  future  audits  wiii  be  decreased  based  on  assurance  provided  by 
adequate  controis. 


Inadequate  in  part 

Auditors  identified  one 

Contractor  is  required  to  make  improvements,  and  DCAA  is  to  perform  foiiow-up 

or  more  significant 

testing  within  6  months. 

deficiencies  that  affect 

Inadequate  in  part  opinion  aiso  requires  expanded  audit  scopes  on  future  and 

parts  of  the  contractor’s 

concurrent  audits  untii  the  contractor’s  corrective  actions  are  confirmed  by 

system 

the  auditors. 

Auditors  identified  one 
or  more  significant 
deficiencies  that  render 
the  entire  contractor 
system  unreiiabie 


Contractor  is  required  to  make  improvements  and  DCAA  is  to  perform  foiiow-up 
testing  within  6  months. 

Inadequate  opinion  requires  expanded  audit  scopes  on  other  audits  because 
controis  do  not  provide  reasonabie  assurance  that  data  generated  by  the 
contractor's  system  are  reiiabie. 


Source:  GAO  analysis  of  DCAA  policy. 


Supervisors  of  the  DCAA  internal  control  audits  we  reviewed  dropped 
auditor  findings  of  significant  deficiencies  from  the  audit  reports  or 
treated  them  as  suggestions  for  improvement  without  adequate  support, 
including  instances  of  FAR  noncompliance  that  should  have  been  reported 
as  material  weaknesses.  In  some  cases,  auditors  reported  “inadequate-in 
part”  opinions  when  the  severity  of  the  deficiencies  or  material 
weaknesses  identified  would  have  called  for  “inadequate”  opinions. 

On  December  19,  2008,  DCAA  revised  its  policy  to  eliminate  the 
“inadequate-in-part”  opinion  and  the  requirement  to  report  suggestions  for 
improvement.''^  The  new  DCAA  policy  defines  “significant 
deficiency/material  weakness”  as  an  internal  control  deficiency  that 
(1)  adversely  affects  the  contractor’s  ability  to  initiate,  authorize,  record, 
process  or  report  government  contract  costs  in  accordance  with 
applicable  government  contract  laws  and  regulations;  (2)  results  in  a 
reasonable  possibility  that  unallowable  costs  will  be  charged  to  the 
government;  and  (3)  the  potential  unallowable  cost  is  not  clearly 
immaterial.  The  new  DCAA  policy  also  establishes  new  guidance  on 


^^DCAA,  “Audit  Guidance  on  Significant  Deficiencies/Material  Weaknesses  and  Audit 
Opinions  on  Internal  Control  Systems,”  08-PAS-043R  (Dec.  19,  2008). 
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reporting  audit  opinions  on  contractors’  internal  control  systems.  For 
example,  the  new  DCAA  policy  states  that  audit  reports  that  identify  any 
significant  deficiencies/material  weaknesses  in  contractors’  internal 
control  systems  will  include  opinions  that  the  systems  are  “inadequate.” 
The  policy  notes  that  the  contractor’s  failure  to  accomplish  any  control 
objective  tested  in  DCAA’s  internal  control  audits  will  or  could  ultimately 
result  in  unallowable  costs  being  charged  to  government  contracts,  even 
when  the  control  objective  does  not  have  a  direct  relationship  to  charging 
costs  to  government  contracts.  As  an  example,  the  policy  notes  the  control 
objective  related  to  ethics  and  integrity  is  not  directly  related  to  charging 
costs  to  government  contracts,  but  that  the  contractor’s  failure  to 
accomplish  the  control  objective  creates  an  environment  that  could 
ultimately  result  in  mischarging  to  government  contracts. 

By  eliminating  the  “inadequate-in-part”  opinion,  the  new  policy  does  not 
recognize  different  levels  of  severity  and  could  unfairly  penalize 
contractors  whose  systems  have  less  severe  deficiencies  by  giving  them 
the  same  opinion — ’’inadequate” — as  contractors  having  material 
weaknesses  or  serious  deficiencies  that  in  combination  would  constitute  a 
material  weakness. 

At  the  time  we  finalized  our  draft  report  for  DOD  comment,  DCAA  had 
rescinded  18  of  the  33  audits  of  contractor  internal  controls  that  we 
determined  did  not  contain  sufficient  testing  to  meet  GAGAS.  Unreliable 
audit  opinions  on  contractor  internal  controls  pose  a  significant  risk 
because  DCAA  generally  performs  these  audits  on  a  2-  to  4-year  cycle  and 
the  audit  results  are  relied  on  for  several  years  to  make  decisions  on 
testing  in  various  audits  of  contractor  internal  controls  and  cost-related 
assignments.  In  response  to  our  earlier  investigation  in  November  2008, 
DOD  added  DCAA  audits  not  meeting  professional  standards  to  its  list  of 
material  weaknesses.''^  Table  2  provides  details  on  five  case  studies  that 
are  typical  of  the  flawed  internal  control  audits  that  we  reviewed  during 
the  course  of  our  work.  For  more  detail  on  the  internal  control  audits  we 
reviewed,  see  appendix  1. 


Under  its  decentralized  management  environment,  DCAA  headqueirters  obtains  field 
office  agreement  to  rescind  audit  reports  that  do  not  meet  GAGAS. 

DOD,  Fiscal  Year  2008  Agency  Financial  Report,  Department  of  Defense  (Washington, 
D.C.:  Nov.  17,  2008). 
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Table  2:  Summary  of  Five  Selected  Internal  Control  Audits 


Case  Region  Audit  type 

1  Western  Billing  system  (2004) 


2  Western  Accounting  system 
(2004) 


Case  details 

•  DCAA  auditors  inappropriately  planned  and  performed  a  billing  system  audit  of  a 
federally  funded  research  and  development  center  (grantee)  with  $1.5  billion  in  annual 
funding.  The  grantee  does  not  have  a  "billing  system." 

•  The  grantee  is  funded  by  a  line  of  credit,  which  provides  for  cash  draws  and 
transaction  reporting  by  the  grantee's  accounting  system. 

•  DCAA  auditors  spent  530  hours  revising  Single  Audit  Act  cash  management  audit 
documentation  to  address  procedures  required  in  DCAA's  standard  audit  program  for 
billing  system  internal  controls  and  developed  a  billing  system  audit  report,  when  the 
auditors  could  have  simply  forwarded  the  results  of  work  on  the  grantee's  cash 
management  system  performed  underthe  Single  AuditActto  the  federal  agency's 
buying  command. 

•  As  a  result  of  our  review,  DCAA  reassessed  the  need  to  perform  a  billing  system  audit 
for  the  grantee  and  determined  that  it  would  rely  on  the  Single  Audit  reports  in  the 
future. 

•  This  audit  involving  accounting  controls  for  one  of  the  five  largest  DO  D  contractors 
working  in  Iraq  was  initiated  in  November  2003. 

•  In  September  2005,  after  nearly  2  years  of  audit  work,  DCAA  provided  draft  findings 
and  recommendations  to  the  contractor  that  included  8  significant  deficiencies  in  the 
contractor's  accounting  design  and  operation. 

•  The  contractor  objected  to  the  findings,  stating  that  the  auditors  did  not  fully 
understand  its  new  policies  and  procedures,  which  were  just  being  developed  for  the 
fast  track  effort  in  Iraq. 

•  Following  the  contractor's  objections,  various  supervisory  auditors  directed  the 
auditors  to  revise  and  delete  some  workpapers,  generate  new  workpapers,  and  in  one 
case,  copy  the  signature  of  a  prior  supervisor  onto  new  workpapers  making  it  appear 
that  the  prior  supervisor  had  approved  a  revised  risk  assessment. 

•  On  August  31,  2006,  after  dropping  5  significant  deficiencies  and  downgrading  3 
significant  deficiencies  to  suggestions  for  improvement,  DCAA  reported  an  "adequate" 
opinion  on  the  contractor's  accounting  system  without  adequate  audit  evidence  for  the 
changes. 

•  The  interim  audit  supervisor,  who  instructed  the  lead  auditor  to  copy  and  paste  the 
prior  supervisor's  name  onto  key  risk  assessment  workpapers,  was  subsequently 
promoted  to  be  the  Western  Region's  quality  assurance  manager  where  he  served  as 
quality  control  check  over  thousands  of  audits,  including  those  GAO  reported  on  last 
year. 

•  In  April  2007,  the  Special  IG  for  Iraq  Reconstruction  (SIGIR)  reported  that  despite 
being  paid  $3  million  to  complete  the  renovation  of  a  building  in  Iraq,  the  contractor's 
work  led  to  plumbing  failures  and  electrical  fires  in  a  building  occupied  by  the  Iraqi 
Civil  Defense  Directorate. 

•  DCAA  rescinded  the  audit  report  on  December  2,  2008. 
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Case  Region  Audit  type 

3  Eastern  Billing  system  (2005) 


4  Central  Billing  system 
(2005) 


Case  details 

•  In  May  2005,  DCAA  reported  an  inadequate-in-part  opinion  on  the  billing  system 
internal  controls  of  a  second  of  the  five  largest  DO  D  contractors. 

•  After  issuing  the  report,  DCAA  auditors  helped  the  contractor  develop  policies  and 
procedures  related  to  accounts  receivable,  overpayments,  and  system  monitoring 
before  performing  a  required  follow-up  audit— a  serious  impairment  to  auditor 
independence. 

•  In  J  une  2006,  DCAA  reported  an  adequate  opinion  on  the  contractor's  billing  system 
internal  controls,  including  the  policies  and  procedures  DCAA  helped  the  contractor 
develop. 

•  As  a  result  of  GAO's  review,  DCAA  rescinded  the  follow-up  audit  report  on  March  6, 
2009. 

•  This  audit,  which  was  initiated  in  J  uly  2005,  covered  a  new  billing  system  at  a 
business  segment  of  another  of  the  five  largest  DO  D  contractors.  Although  DCAA 
considers  new  systems  to  be  high-risk  and  requires  increased  testing,  auditors 
deleted  key  audit  steps  related  to  contractor  policies  and  internal  controls  over 
progress  payments  from  the  standard  audit  program  without  explanation  and 
performed  little  or  no  testing  of  the  contractor's  billing  controls. 

•  The  contractor  objected  to  requests  for  documentation  to  test  whether  billing  clerks 
had  received  necessary  training. 

•  One  auditor  told  GAO  he  did  not  perform  other  tests  because  'the  contractor  would 
not  appreciate  it." 

•  The  auditors  provided  draft  findings  and  recommendations  to  the  contractor  in 
February  2006  that  included  six  suggestions  to  improve  the  system  related  to  the 
need  for  internal  audits,  oversight  of  subcontractor  accounting  systems,  and 
improvements  in  policies  and  procedures  and  desk  instructions. 

•  Instead  of  issuing  the  report,  when  audit  work  was  completed  and  noting  the  status  of 
any  contractor  actions  to  address  identified  control  weaknesses,  the  auditors 
monitored  contractor  corrective  actions  for  7  months,  dropping  the  two  suggestions  for 
improvement  related  to  internal  audits  and  monitoring  subcontractor  accounting 
systems.  The  failure  to  monitor  subcontractor  accounting  systems  should  have  been 
considered  a  significant  deficiency. 

•  On  September  15,  2006,  DCAA  reported  an  "adequate" opinion  on  the  contractor's 
billing  system. 

•  Following  GAO's  review  ofthis  audit,  DCAA  rescinded  the  audit  report  on  February 
10,  2009. 
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Case  Region  Audit  type 

5  Central  Billing  system  (2006) 


Case  details 

•  A  fraud  investigation  by  the  Army's  Criminal  Investigative  Division  was  under  way  at 
the  time  DCAA  performed  this  contractor's  billing  system  audit.  The  FAO  was  aware 
of  the  substance  of  the  Army's  investigation. 

•  The  auditor  requested  increases  in  budgeted  audit  hours  to  perform  increased  testing 
because  of  fraud  risk  and  the  contractor's  use  of  temporary  accounts  for  charging 
costs  that  had  not  yet  been  authorized  by  the  contracting  officer. 

•  The  auditor  drafted  an  "inadequate"  opinion  on  the  contractor's  billing  system,  which 
was  overturned  by  the  supervisor  and  FAO  manager. 

•  Despite  a  reported  $2.8  million  in  fraud  for  this  contractor,  DCAA  reported  an 
"inadequate-in-part"  opinion  related  to  3  significant  deficiencies  in  the  contractor's 
billing  system  on  August  31,  2005,  and  an  "adequate"  opinion  on  September  11, 

2006,  related  to  a  follow-up  audit. 

•  The  auditor,  whose  performance  appraisal  was  lowered  for  performing  too  much 
testing  and  exceeding  budgeted  audit  hours,  was  assigned  to  and  then  removed  from 
the  follow-up  audit.  The  auditor  left  DCAA  in  March  2007. 

•  Following  GAO's  review,  DCAA  rescinded  both  audit  reports  on  November  20,  2008. 


Source:  GAO  analysis  of  DCAA  audit  documentation  and  auditor  interviews. 


Cost-Related  Assignments  The  32  cost-related  assignments  we  reviewed  did  not  contain  sufficient 

testing  to  provide  reasonable  assurance  that  overpayments  and  billing 
errors  that  might  have  occurred  were  identified.  As  a  result,  there  is  little 
assurance  that  any  such  errors,  if  they  occurred,  were  corrected  and  that 
related  improper  contract  payments,  if  any,  were  refunded  or  credited  to 
the  government.  Contractors  are  responsible  for  ensuring  that  their 
billings  reflect  fair  and  reasonable  prices  and  contain  only  allowable  costs, 
and  taxpayers  expect  DCAA  to  review  these  billings  to  provide  reasonable 
assurance  that  the  government  is  not  paying  more  than  it  should  for  goods 
and  services.  Further,  we  found  that  DCAA  does  not  consider  some  cost- 
related  assignments  to  be  GAGAS  audits,  even  though  these  assignments 
are  used  to  provide  assurance  of  the  reasonableness  of  contractor  billings, 
for  example: 

Paid  voucher  reviews.  DCAA  performs  annual  testing  of  paid  vouchers 
(invoices)  to  determine  if  contractor  voucher  preparation  procedures  are 
adequate  for  continued  contractor  participation  in  the  direct-bill 
program.'*®  Under  the  direct-bill  program,  contractors  may  submit  their 
invoices  directly  to  the  DOD  disbursing  officer  for  payment  without 
further  review.  Although  DCAA  does  not  consider  its  reviews  of  contractor 


'*®  DCAA  does  not  perfom  paid  voucher  reviews  during  the  year  that  it  performs  an  audit  of 
the  contractor’s  billing  system  internal  controls. 
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paid  vouchers  to  be  GAGAS  engagements;  it  has  not  determined  what 
standards,  if  any,  apply  to  these  assignments.  In  addition,  for  the  16  paid 
voucher  assignments  we  reviewed,  we  found  that  DCAA  auditors  failed  to 
comply  with  CAM  guidance.'*'’  Rather  than  documenting  the  population  of 
vouchers,  preparing  sampling  plans,  and  testing  a  random  (statistical) 
sample,  auditors  generally  did  not  identify  the  population  of  vouchers,  did 
not  create  sampling  plans,  and  made  a  small,  nonrepresentative  selection 
of  as  few  as  one  or  two  invoices  for  testing  to  support  conclusions  on  their 
work.  Even  when  DCAA  auditors  tested  20  or  30  invoices,  they  did  not  test 
billing  controls  or  review  supporting  documentation  for  goods  and 
services  purchased.  Instead,  the  auditors  performed  limited  procedures 
such  as  determining  whether  the  vouchers  were  mathematically  correct 
and  included  current  and  cumulative  billed  amounts.  Based  on  this  limited 
work,  the  auditors  concluded  that  controls  over  invoice  preparation  were 
sufficient  to  support  approval  of  the  contractors’  direct  billing  privileges. 
However,  the  limited  work  performed  does  not  provide  assurance  that 
contractor  billings  are  accurate  and  comply  with  applicable  laws,  the  FAR, 
CAS,  and  contract  terms.  This  is  of  particular  concern  because  we 
determined  that  Defense  Finance  and  Accounting  Service  (DFAS) 
certifying  officers  rely  on  DCAA  voucher  reviews,  and  they  do  not  repeat 
review  procedures  they  believe  to  be  performed  by  DCAA. 

Professional  literature  contains  guidance  to  help  auditors  determine  the 
level  of  testing  that  should  be  performed  to  obtain  sufficient,  appropriate 
evidence  to  support  a  conclusion  that  internal  controls  are  effectively 
designed,  implemented,  and  operating  effectively.  Inquiry  alone  does  not 
provide  sufficient,  appropriate  evidence  to  support  a  conclusion  about  the 
effectiveness  of  a  control.  Some  of  the  factors  that  affect  the  risk 
associated  with  a  control  include 

•  the  nature  and  materiality  of  misstatements  that  the  control  is  intended 
to  prevent, 

•  the  inherent  risk  associated  with  the  related  account(s)  and 
assertion(s), 

•  whether  there  have  been  changes  in  the  volume  or  nature  of 
transactions  that  might  adversely  affect  control  design  or  operating 
effectiveness. 


CAM  6-1007. 
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•  the  degree  to  which  the  control  relies  on  the  effectiveness  of  other 
controls  (i.e.,  information  technology  controls), 

•  the  competence  of  personnel  who  perform  the  control  or  monitor  its 
performance,  and  whether  there  have  been  changes  in  key  persormel 
who  perform  the  control  or  monitor  performance,  and 

•  whether  the  control  relies  on  performance  by  an  individual  or  is 
automated  (an  automated  control  would  generally  be  expected  to  be 
lower  risk  if  relevant  IT  general  controls  are  effective). “ 

Professional  standards^^  state  that  the  auditor  should  focus  more  attention 
on  the  areas  of  highest  risk.  As  the  risk  associated  with  the  control  being 
tested  increases,  the  evidence  that  the  auditor  should  obtain  increases.  In 
addition,  the  GAO/PCIE  Financial  Audit  Manual  provides  guidance  on 
sampling  control  tests  that  would  be  relevant  to  DCAA  testing  of 
contractor  invoices.  The  auditor  should  assess  risk  in  determining  the 
control  attributes  to  be  tested  and  select  a  sample  that  the  auditor  expects 
to  be  representative  of  the  population.  Attribute  sampling  requires  random 
or  systematic,  if  appropriate,  selection  of  sample  items  without 
considering  the  transactions’  dollar  amount  or  other  special 
characteristics.  To  determine  the  sample  size,  the  auditor  uses 
professional  judgment  to  determine  three  factors — confidence  level, 
tolerable  rate  (maximum  rate  of  deviations  from  the  prescribed  control 
that  the  auditor  is  willing  to  accept  without  altering  the  preliminary 
control  risk),  and  expected  population  deviation  rate  (expected  error 
rate)."'' 


""  AU  §  350.19  and  SSAE  §§16.64  and  15.69. 

AU  §§  350.07  through  350.14. 

GAO-08-585G,  §  450. 

""  Confidence  interval  is  the  probability  associated  with  the  precision,  that  is,  the 
probability  that  the  true  misstatement  is  within  the  confidence  interval. 

For  example,  for  a  confidence  level  of  90  percent  and  a  tolerable  rate  of  5  percent,  a 
sample  size  of  46  transactions  would  have  an  acceptable  number  of  deviations  of  zero  and 
a  sample  size  of  78  transactions  would  have  an  acceptable  number  of  deviations  of  one.  For 
the  same  confidence  level  of  90  percent  and  a  tolerable  rate  of  10  percent,  a  sample  size  of 
45  would  have  an  acceptable  number  of  deviations  of  one  and  a  sample  size  of  78  would 
have  an  acceptable  number  of  deviations  of  four. 
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Finally,  the  American  Institute  of  Certified  Public  Accountants  (AlCPA) 
Audit  and  Accounting  Guide:  Audit  Sampling^^  (Audit  Guide)  contains 
attestation  guidance  on  the  application  of  SSAEs  in  specific 
circumstances,  including  engagements  for  entities  in  specialized 
industries.  The  Audit  Guide  states  that  an  auditor  using  nonstatistical 
sampling  is  not  required  to  compute  the  sample  size  using  statistical 
theory.  However,  sample  sizes  of  statistical  and  nonstatistical  samples 
ordinarily  would  be  comparable  when  the  same  sampling  parameters  are 
used.^® 

Overpayment  assignments.  DCAA  intends  these  audits  to  verify  that 
contractors  have  billing  procedures  and  internal  controls  in  place  to 
identify  and  resolve  contractor  overpayments  in  a  timely  marmer.  DCAA 
guidance  states  that  these  engagements  should  be  conducted  in 
accordance  with  GAGAS  to  the  extent  applicable  under  the 
circumstances.^^  However,  none  of  the  10  overpayment  assignments  we 
reviewed  were  performed  or  reported  as  GAGAS  engagements.  We  found 
that  auditor  judgments  about  the  population  and  selection  of  transactions 
for  these  assignments  did  not  provide  a  representative  basis  for  testing 
and  concluding  on  contractor  controls  over  billings  and  payments 
received.  For  example,  for  the  10  assignments  we  reviewed,  the  auditors 
selectively  reviewed  an  accounts  receivable  aging  report  to  identify 
overpayments  and  determine  if  they  had  been  resolved.  The  auditors  did 
not  attempt  to  identify  the  population  of  transactions  subject  to 
overpayments  and  over  billings  during  the  year,  and  they  did  not 
document  their  rationale  for  selecting  a  particular  dollar  threshold, 
number  of  transactions,  or  time  period  for  testing  contractor  invoices.  Our 
assessment  of  these  assignments  includes  the  same  concerns  regarding 
insufficient  evidence  to  support  the  auditors’  conclusions  as  discussed 
above  for  annual  testing  of  paid  vouchers.  As  a  result,  this  work  does  not 
provide  reasonable  assurance  that  contractors  have  adequate  controls  in 
place  to  identify  and  correct  overpayments  and  billing  errors  and  make 
appropriate,  timely  refunds  and  adjustments. 


^  The  MCPAAudit  Guide  is  an  interpretive  publication  pursuant  to  AT  section  50,  SSAE 
Hierarchy  (AICPA,  Professional  Standards,  vol.  1). 

^  MCPAAudit  Guide  §  1-17,  and  AU  §  360.23.  Statements  on  Auditing  Standards  (SAS)  39 
is  referred  to  as  AU  350. 

DCAA,  “Audit  Program:  Audit  of  Contractor  Overpayments,”  (Activity  Code  17310),  April 
2004,  September  2007,  and  May  2008. 
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Incurred  cost  audits.  The  purpose  of  incurred  cost  audits  is  to  examine 
contractors’  cost  representations  and  opine  on  whether  the  costs  are 
allowable,  allocable  to  government  contracts,  and  reasonable  in 
accordance  with  the  contract  and  applicable  government  acquisition 
regulations.  DCAA  performs  these  audits  as  GAGAS  attestation 
engagements.  For  the  four  incurred  cost  audits  we  reviewed,  we  found 
that  the  auditors  did  not  adequately  document  their  judgments  about 
control  risk  or  the  sampling  and  test  methodologies  used.  In  addition,  we 
found  that  the  auditors  traced  claimed  pool  and  base  costs  (indirect  costs) 
to  the  contractor’s  accounting  books  and  records  to  determine  their 
accuracy  and  allowability.  However,  the  auditors  did  not  perform 
sufficient,  detailed  testing  of  support  for  claimed  indirect  and  direct  costs. 
The  scope  of  work  performed  was  not  sufficient  to  identify  claimed  costs, 
if  any,  that  were  not  adequately  supported  or  unallowable  costs,  if  any, 
that  should  have  been  questioned. 

In  addition  to  the  testing  failures  we  identified  on  the  32  cost-related 
assignments,  several  additional  issues  came  to  our  attention  during  our 
review: 

Exempting  from  professional  standards  certain  assignments  that 
were  nsed  as  snpport  for  internal  control  system  andits.  We  noted 
that  paid  voucher  reviews  and  overpayment  assignments,  which  were  used 
to  support  direct-bill  decisions  and  billing  system  audits,  were  not 
performed  under  GAGAS,  even  though  some  of  them  used  the  same 
terminology  as  GAGAS  engagements  to  describe  the  work  performed, 
including  “comprehensive  examination”  and  “audit.”  According  to  DCAA’s 
CAM  and  DCAA  officials,  paid  voucher  reviews  and  most  overpayment 
assignments  are  not  intended  to  meet  GAGAS  standards.  However,  paid 
voucher  reviews  are  intended  to  serve  as  audits  of  contractor  payments, 
and  DCAA’s  standard  audit  program  for  overpayment  assignments  states 
that  the  assignments  are  to  be  performed  in  accordance  with  GAGAS, 
unless  there  are  specific  exceptions.  When  these  types  of  assignments  are 
not  conducted  under  professional  standards,  it  is  important  for  the  report 
to  clearly  state  the  procedures  performed  and  the  intended  uses  of  the 
report,  such  as  verifying  compliance  with  certain  FAR  requirements,  in 
order  to  provide  context  for  understanding  the  stated  conclusions  of  the 
work  and  avoid  misleading  users  of  the  report. 


CAM  6-102. 
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Auditor  objectivity  issues.  We  also  determined  that  DCAA’s  role  with 
regard  to  making  decisions  to  approve  contractors  for  participation  in  the 
direct-bill  program'^'’  presented  an  impairment  to  auditor  objectivity — 
which  includes  being  independent  in  fact  and  appearance  when  providing 
audit  and  attestation  engagements.™  The  objectivity  impairment  relates  to 
DCAA’s  audit  role  in  authorizing  contractors  to  participate  in  the  direct- 
bill  program,  which  places  it  in  the  position  of  making  decisions  that 
impact  its  nonaudit  workload  related  to  the  review  of  contractor  invoices 
prior  to  payment.  For  example,  when  contractors  do  not  have  direct  billing 
privileges,  DCAA  acts  as  the  authorized  representative  of  the  DOD 
contracting  officer  in  reviewing  contractor  invoices  prior  to  submission 
for  payment.  However,  if  DCAA  auditors  determine  that  a  contractor  has 
an  adequate  billing  system,  DCAA  may  authorize  a  contractor  to 
participate  in  the  direct-bill  program,  thereby  eliminating  workload  related 
to  review  of  the  contractor’s  invoices  prior  to  payment.  In  addition,  the  20 
billing  system  audits  and  follow-up  audits  we  reviewed  lacked  sufficient 
testing  to  support  reported  opinions,  or  the  opinions  reported  were 
inconsistent  with  the  audit  evidence.  DCAA  had  approved  all  but  2  of  the 
16  contractors  involved  in  these  audits  for  the  direct  bill  program. 

At  the  end  of  our  audit,  DCAA  had  not  rescinded  any  of  the  memorandums 
or  reports  on  the  results  of  the  cost-related  assignments  we  reviewed. 
Table  3  provides  details  on  five  selected  case  studies  of  flawed  cost- 
related  assignments  that  we  reviewed  during  the  comse  of  om  work. 


™  FAR  42.101,  DFARS  242.803(b)(1)(c),  and  CAM  6-1007. 
™  GAO-03-673G,  §§  3.03  through  3.18. 
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Table  3:  Summary  of  Five  Selected  Cost-Related  Assignments 


Case  Region 

1  Eastern 


2  Mid-Atlantic 


3  Western 


Type  of 
assignment 

Paid  voucher  review 
(2004) 

Non-GAGAS 


Paid  voucher  review 
(2004) 

Non-GAGAS 


Case  details 

•  This  contractor  generates  $1.1  billion  in  annual  billings  to  the  government. 

•  The  auditor  assessed  risk  as  low  for  this  assignment  without  documenting  the  basis 
for  the  decision.  The  auditor  then  judgmentally  selected  3  vouchers  totaling  $88,000 
for  testing  out  of  a  total  of  222  vouchers  submitted  to  the  government  for  payment 
from  March  2003  through  February  2004. 

•  The  auditor  tested  the  first  voucher  selected  and  performed  limited  testing  on  the 
remaining  2  vouchers.  The  workpapers  do  not  include  any  evidence  to  show  that  the 
auditor  performed  most  of  the  audit  steps  required  in  the  standard  audit  program. 

•  Despite  limited  testing,  on  March  31,  2004,  DCAA  prepared  a  Memorandum  for  the 
Record,  stating  "continued  reliance  can  be  placed  on  the  contractor's  procedures  for 
the  preparation  of  interim  vouchers... "  and  "the  contractor  has  met  the  criteria  for 
continued  participation  in  the  direct  billing  program." 

•  In  2004,  DCAA  reviewed  interim  vouchers  submitted  by  a  contractor  with  $40  million 
in  annual  sales. 

•  The  auditor  chose  a  nonrepresentative  selection  of  3  vouchers  totaling  $621,000 
from  a  3-month  period.  The  auditor  should  have  used  a  population  covering  a  12- 
month  period  because  this  assignment  was  designed  to  cover  a  1-year  period. 

•  The  auditor  did  not  document  the  sample  selection  methodology  as  required  by 
DCAA's  CAM.  Although  testing  of  3  vouchers  is  not  sufficient  to  support  a 
conclusion  on  the  effectiveness  of  the  contractor's  controls  over  preparation  of 
interim  vouchers,  the  auditor  removed  one  of  the  3  vouchers  from  testing  and  did  not 
document  a  reason. 


Paid  voucher 
review  (2005) 
Non-GAGAS 


The  auditor  did  not  identify  any  errors  in  testing  the  two  remaining  vouchers. 

On  August  31,  2004,  DCAA  reported  "continued  reliance  can  be  placed  on  the 
contractor's  procedures  for  the  preparation  of  interim  vouchers"  and  'the  contractor 
had  met  the  criteria  for  continued  participation  in  the  direct  billing  program." 

This  DOD  contractor  with  over  $1  billion  in  annual  billings  to  the  government  was 
one  of  several  contractors  that  performed  work  to  support  the  FBI's  T  rilogy 
investigative  systems  upgrade  project. 

The  auditor  tested  less  than  20  vouchers  of  5,530  vouchers  issued  in  a  12-month 
period. 

On  April  14,  2005,  DCAA  issued  a  Memorandum  for  the  Record,  stating  "continued 
reliance  can  be  placed  on  the  contractor's  procedures  for  the  preparation  of  interim 
vouchers"  and  'the  contractor  has  met  the  criteria  for  continued  participation  in  the 
direct-bill  program. 

One  year  later,  a  GAO  audit  report  revealed  that  during  the  time  of  this  DCAA 
assignment,  the  contractor  had  over  billed  the  FBI  by  over  $400,000  in  labor  and 
improper  first-class  travel  costs. 


Page  28 


GAO-09-468  DCAA  Audit  Environment 


Type  of 

Case 

Region 

assignment 

Case  details 

4 

Central 

Overpayment 
assignment  (2005) 

Non-GAGAS 

•  This  DCAA  assignment  covered  one  of  the  five  largest  DO  D  contractors. 

•  The  auditor  tested  4  transactions  from  a  listing  of  potential  underpayments  and 
overpayments  prepared  by  the  contractor.  The  auditor  did  not  independently  verify 
the  accuracy  or  completeness  of  the  contractor's  listing. 

•  The  audit  program  required  the  auditor  to  determine  whether  the  contractor  monitors 
the  billings  submitted  by  its  top  3  to  5  subcontractors.  Flowever,  the  auditor 
performed  this  procedure  for  only  1  subcontractor  based  on  "auditor  judgment"  and 
did  not  document  the  basis  for  this  judgment  in  the  audit  documentation. 

•  The  auditor  also  relied  on  the  unverified  contractor-provided  listing  to  identify 
refunds  to  the  government.  The  auditor  then  "judgmentally  selected"  2  refunds  for 
testing  from  the  contractor's  listing. 

•  The  auditors' conclusions  that  the  contractor's  controls  are  sufficient  to  detect  and 
correct  billing  errors  and  overpayments  were  not  supported  by  sufficient  testing  or 
other  independent  evidence. 

5 

Western 

Incurred  cost 
audit  (2004) 

GAGAS 

•  This  audit  covered  a  $516  million  incurred  cost  claim  submitted  by  a  contactor 
performing  reconstruction  work  in  Iraq. 

•  The  auditors  reported  about  $6  million  in  questioned  costs  and  about  $83  million  in 
unsupported  costs  based  on  assist  audits  (portions  of  the  audit  performed  by  other 

FAOs)  that  had  not  been  received  by  the  report  issue  date. 

•  Aithough  the  auditors  charged  2,292  hours  to  this  assignment,  GAO  determined  that 
the  auditors  did  not  perform  sufficient  work  to  support  the  audit  opinion.  For 
exampie,  the  auditors  traced  ciaimed  pooi  and  base  costs  to  the  contractor's 
accounting  books  and  records  using  a  threshoid  of  $5  miiiion  for  cost-type  contracts 
and  $2  miiiion  for  time  and  materiais  contracts,  but  did  not  perform  detaiied  testing 
of  support  for  transactions.  T racing  amounts  to  the  generai  iedger  is  not  sufficient 
work  to  support  an  examination-ievei  opinion  and  the  auditors  did  not  document  the 
basis  for  the  judgment  used  to  determine  the  muitimiiiion  doiiar  threshoids. 

•  Further,  the  auditors  reiied  on  testing  performed  in  a  reiated  accounting  system 
audit,  which  DCAA  rescinded  on  December  2,  2008,  in  response  to  GAO  concerns. 

•  As  a  resuit,  the  auditor's  risk  assessment  used  to  pian  the  incurred  cost  audit  is  no 
ionger  supported. 


Source:  GAO  analysis  of  DCAA  audit  documentation  and  auditor  interviews. 


We  did  not  attempt  to  re-perform  these  assignments  to  find  out  whether 
actual  overpayments  or  billing  errors  existed.  For  additional  details  on  the 
cost-related  assignments  we  reviewed,  see  appendix  11. 


Poor  Management 
Environment  and  Quality 
Assurance  Structure  at 
DCAA  Impacted  Audit 
Quality 


We  found  that  a  management  environment  and  agency  culture  that 
focused  on  facilitating  the  award  of  contracts  and  an  ineffective  audit 
quality  assurance  structure  are  at  the  root  of  the  agencywide  audit  failures 
we  identified.  DCAA’s  mission  and  management  goals  focus  on  producing 
a  large  quantity  of  audits  to  support  procurement  and  contract 
administration  rather  than  assuring  proper  contract  costs  that  help  save 
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DCAA’s  Mission  Statement  and 
Strategic  Plan  Do  Not  Focus  on 
the  Public  Interest 


taxpayer  dollars.  In  addition,  an  ineffective  audit  quality  control  system 
and  a  “clean”  peer  review  opinion  compounded  the  problem,  hindering 
DCAA  management  from  identifying  and  correcting  agencywide  audit 
quality  problems. 

DCAA’s  current  mission  statement  does  not  address  protecting  the  public 
interest  in  the  manner  in  which  it  carries  out  audits  to  help  assure  that 
contractors  charge  fair  and  reasonable  prices  that  comply  with  applicable 
laws  and  regulations,  cost  accoimting  standards,  and  contract  terms. 
Instead,  DCAA’s  mission  statement  calls  for  it  to  perform  all  necessary 
contract  audits  for  DOD  and  provide  accounting  and  financial  advisory 
services  regarding  contracts  and  subcontracts  to  all  DOD  components 
responsible  for  procurement  and  contract  administration.  Similarly, 
DCAA’s  2006  strategic  plan  focused  on  various  processes  and  outputs. 
DCAA’s  strategic  plan  contains  the  following  five  strategic  goals  with 
targeted  completion  dates  from  2006  through  2008: 

1.  fostering  a  quality  work-life  environment  that  promotes  trust, 
teamwork,  mutual  respect,  superior  job  performance  and  high  morale; 

2.  assuring  customer  satisfaction  by  providing  timely  and  responsible 
audits  and  financial  services  that  meet  or  exceed  customer 
requirements  and  expectations; 

3.  attaining  the  highest  level  of  professional  competence  through 
continuous  improvement  in  the  management  and  performance  of 
audits  and  services; 

4.  providing  best  value  audit  and  financial  services  through  continuous 
evaluation  and  improvement  of  audit  and  administrative  processes; 
and 

5.  providing  an  integrated  information  technology  structure  that 
promotes  effectiveness  and  efficiency  in  providing  services  for  internal 
and  external  customers. 

DCAA  objectives  under  each  strategic  goal  focus  on  process 
improvements  and  do  not  contain  a  clear  plan  for  achieving  the  respective 
goal  or  adequate  quantitative  and  qualitative  measures  for  determining 
success,  for  example: 

•  One  DCAA  quality  of  work-life  objective  is  to  assess  whether  the 
participative  work  team  concept  is  the  best  model  for  facilitating 
continuous  process  improvement.  The  underlying  activities  include 
internal  meetings  and  brainstorming  sessions,  literature  reviews,  and 
developing  recommendations  for  executive  committee  review.  None  of 
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the  activities  included  refer  to  identifying  best  practices  or  working 
with  outside  experts. 

•  Another  objective  is  to  hold  or  lower  attrition  in  high  turnover  areas. 
DCAA  activities  in  this  area  include  analyzing  causes  of  attrition,  and 
conducting  surveys  of  new  hires  and  departing  employees.  None  of  the 
related  activities  include  surveys  of  like  organizations,  consideration  of 
best  practices,  or  identifying  and  addressing  causes  of  high  attrition. 
Moreover,  in  response  to  our  requests  for  attrition  data,  DCAA 
provided  high-level  summaries  without  any  analysis. 

•  DCAA’s  strategic  goal  for  customer  satisfaction,  included  the  objective 
of  increasing  by  20  percent  annually  the  number  of  incurred  cost  audit 
reports  issued  with  contractor  cumulative  allowable  cost  worksheets, 
completing  100  percent  of  identified  incurred  cost  audits  necessary  to 
accomplish  Defense  Contract  Management  Agency  (DCMA) 
performance  goals  for  contract  close-out  and  canceling  funds.  “ 

DCAA’s  strategic  plan  contains  no  explanation  of  the  importance  of 
these  objectives  or  how  they  link  to  DCAA’s  mission. 

•  A  key  goal  related  to  best  value  audit  services  is  for  DCAA  to  manage 
its  cost  per  direct  audit  hour  at  a  level  sufficient  to  maintain  DCAA’s 
competitive  advantage  over  the  comparable  national  public  firm 
composite  rate.  One  of  the  ways  DCAA  has  achieved  a  low  cost  per 
audit  hour  is  to  maintain  a  pay  structure  that  caps  journey-level 
auditors  at  the  GS-12  level.  In  addition,  our  work  identified  numerous 
instances  where  entry-level  auditors  with  little  or  no  experience  often 
perform  audit  assignments  by  themselves.  However,  lower  grade  levels 
and  limited  experience  can  place  auditors  at  a  disadvantage  when 
dealing  with  contractor  officials. 

The  Government  Performance  and  Results  Act  of  1993  (GPRA)®^  directed 
federal  agencies  to  shift  their  focus  from  traditional  concerns  of  staffing 
and  activity  levels  to  a  broad  focus  on  outcomes  or  results  by  (1)  defining 
a  clear  mission  and  desired  outcomes  instead  of  outputs,  (2)  measuring 
performance  to  gauge  progress,  and  (3)  using  performance  information  as 
a  basis  for  decision  making.  The  act  required  agencies  to  meet  with 
Congress  and  key  stakeholders  to  clearly  define  their  mission  and  develop 


Canceling  funds  refers  to  the  point  in  time  at  which  the  availability  of  a  fixed-year 
appropriation  cancels  and  is  no  longer  available  for  recording,  adjusting,  and  liquidating 
obligations  properly  chargeable  to  the  appropriation.  (31  U.S.C.  §§  1662(a)  and  1653(b)). 

Pub.  L.  No.  103-62,  107  Stat.  286  (Aug.  3,  1993). 
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Performance  Metrics  Were 
Designed  To  Measure  Output 


DCAA’s  Audit  Quality 
Assurance  Program  Was 
Ineffective 


long-term  strategic  goals  as  well  as  annual  goals  that  were  linked  to  them. 
Although  these  legislated  requirements  were  directed  at  federal  agencies, 
including  DOD,  DCAA’s  mission  statement  and  strategic  plan  were  not 
revised  to  conform  to  GPRA  requirements. 

GPRA  also  requires  that  once  federal  agencies  establish  their  strategic 
goals  they  are  to  develop  results-oriented  measures  for  assessing 
performance  in  meeting  those  goals  and  publicly  report  on  how  well  they 
are  doing.  However,  most  of  DCAA’s  performance  metrics  continued  to 
focus  on  output.  Several  DCAA  managers  noted  that  fear  of  outsourcing 
the  contract  audit  function  led  DCAA  to  emphasize  performance  metrics 
that  demonstrated  high  productivity  and  low  cost.  In  fiscal  year  2008, 
DCAA  reported  some  results-oriented  performance  measures,  such  as 
return  on  investment  and  net  savings  related  to  questioned  cost.  However, 
most  of  DCAA’s  metrics  focused  on  production  and  audit  cost,  including 
cost  per  direct  audit  hour,  30-day  cycle  time  on  forward  pricing  audits,  and 
dollars  audited  per  hour.  In  addition,  DCAA’s  focus  on  completing  over 
30,000  assignments  annually  with  about  3,600  auditors  continued  to 
emphasize  production  of  audits  instead  of  performing  quality  audits  that 
assured  taxpayers  that  the  government  was  paying  fair  and  reasonable 
prices  for  contracted  goods  and  services. 

DCAA’s  audit  quality  assurance  program  was  not  properly  implemented, 
resulting  in  an  ineffective  quality  control  process  that  accepted  audits  with 
significant  deficiencies  and  noncompliance  with  GAGAS  and  DCAA  policy. 
Moreover,  even  when  DCAA’s  quality  assurance  documentation  showed 
evidence  of  serious  deficiencies  within  individual  offices,  those  offices 
were  given  satisfactory  ratings.  GAGAS  require  that  each  audit 
organization  performing  audits  and  attestation  engagements  in  accordance 
with  GAGAS  should  have  a  system  of  quality  control  that  is  designed  to 
provide  the  audit  organization  with  reasonable  assurance  that  the 
organization  and  its  personnel  comply  with  professional  standards  and 
applicable  legal  and  regulatory  requirements,  and  have  an  external  peer 
review  at  least  once  every  3  years. 

Our  analysis  of  DCAA  audit  quality  review  documentation  for  14  of  48 
offices  covered  in  audit  quality  reviews  during  fiscal  years  2004  through 
2006 — the  period  covered  in  the  last  DOD  OIG  peer  review — found  that 
although  DCAA  gave  satisfactory  ratings  to  13  of  the  14  FAOs,  DCAA 


®MaO-07-731G,  §§  3.50-3.52. 
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reviewers  reported  that  10  of  these  offices  had  2  or  more  instances  of 
serious  GAGAS  noncompliance,  including  inadequate  plarming,  lack  of 
proper  supervision,  and  insufficient  support  for  reported  conclusions  and 
opinions.  However,  DCAA  gave  only  1  of  the  14  FAOs  reviewed  an 
unsatisfactory  rating.  The  failed  FAO  had  5  of  9  assignments  reviewed  with 
at  least  two  significant  instances  of  noncompliance  with  GAGAS  or  DCAA 
policy.  Further,  although  DCAA  headquarters  performed  a  follow-up 
review  to  confirm  that  problems  identified  at  the  failed  office  were 
corrected,  DCAA  headquarters  officials  told  us  they  did  not  perform 
follow-up  reviews  to  assure  that  the  problems  identified  at  other  offices 
were  corrected. 

In  response  to  a  DOD  IG  finding  that  DCAA  quahty  assurance  reviews  did 
not  cover  a  sufficient  number  of  internal  control  system  audits,  DCAA 
increased  the  number  of  audits  covered  to  date  in  its  fiscal  year  2007  and 
2008  quality  assurance  reviews.  However,  DCAA  continued  to 
inappropriately  conclude  that  audits  “demonstrated  professional 
judgment,”  allowing  reviewers  to  disregard  serious  deficiencies  with 
GAGAS  in  concluding  on  overall  audit  quality.  “  DCAA  failed  only  1  of  the 
40  FAOs  as  a  result  of  its  fiscal  year  2007  and  2008  audit  quality  reviews. 
Our  analysis  of  DCAA’s  audit  quality  results  showed  that  19  of  the  40 
FAO’s  had  two  or  more  audits  with  at  least  2  instances  of  significant 
noncompliance  with  GAGAS  or  DCAA  policy.  However,  18  of  these  FAOs 
received  a  satisfactory  rating.  DCAA  headquarters  has  not  yet  followed  up 
with  offices  that  had  deficient  audits. 

The  examples  in  table  4  show  the  disparity  between  DCAA  quality 
assurance  reports  of  a  “satisfactory  level  of  compliance”  and  actual  results 
documented  by  quality  assurance  reviewers.  The  examples  below  also 
illustrate  the  long-term  nature  of  this  problem. 


^  In  using  professional  judgment,  GAGAS  (GAO-07-731G,  §§  3.32  and  3.35)  require  auditors 
to  act  diligently  in  accordance  with  applicable  professional  standards  and  ethical  principles 
in  all  aspects  of  carrying  out  their  professional  responsibilities. 
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Table  4:  Summary  of  Selected  DCAA  Audit  Quality  Review  Results 

Region 

Number  and  type 
of  audits 

DCAA  audit  quality  review  conclusions  and  findings 

Eastern 

5  incurred  cost 
audits 

On  October  28,  2008,  DCAA  reported  a  satisfactory  level  of  compliance  for  the  FAO  reviewed. 
Supporting  documentation  showed  that  reviewers  found  that  2  of  5  audits  reviewed  had  at  least 

2  instances  of  significant  noncompliance  with  GAGAS  and  DCAA  policy,  including  insufficient 
supervisory  involvement  and  inadequate  workpaper  documentation  to  support  significant  auditor 
judgments  and  conclusions. 

North-eastern 

8  forward  pricing 
audits 

On  September  27,  2007,  DCAA  reported  satisfactory  compliance  by  the  FAO  reviewed. 

Supporting  documentation  showed  that  reviewers  found  that  4  of  8  audits  had  at  least  2 
significant  instances  of  noncompliance  with  GAGAS  or  DCAA  policy  and  2  of  the  4  audits  had  3 
instances  of  noncompliance,  including  inadequate  planning  and  supervision  and  failure  to 
exercise  reasonable  professional  judgment. 

Central 

8  other  (various) 
assignments 

On  April  4,  2006,  reviewers  gave  the  FAO  reviewed  a  satisfactory  rating.  Flowever,  supporting 
documentation  showed  that  audit  quality  reviewers  found  that  2  of  8  assignments  had  at  least 
two  significant  deficiencies  related  to  noncompliance  with  GAGAS  and  DCAA  policy,  including 
inadequate  planning  on  3  assignments  and  inadequate  supervision  on  2  assignments. 

Reviewers  also  determined  thatthe  auditor  on  one  other  assignment  had  not  metthe  annual 
requirement  for  continuing  professional  education. 

Western 

5  incurred  cost 
audits 

0  n  April  26,  2005,  reviewers  gave  the  FAO  a  satisfactory  rating.  Although  the  audit  quality 
review  documentation  identified  only  1  audit  that  had  at  least  2  instances  of  significant 
deficiencies,  the  documentation  noted  limited  testing  and  stated  that  statistical  sampling  was  not 
used,  as  required.  The  reviewers  also  found  that  audit  working  papers  did  not  support  the 
conclusions  in  the  audit  report.  The  reviewers  noted  that  insufficient  supervisory  involvement 
was  responsible  in  part  for  the  deficiencies  found  in  the  audit. 

Mid-Atlantic 

6  incurred  cost 
audits 

On  September  29,  2005,  reviewers  reported  a  satisfactory  level  of  compliance  forthis  FAO. 
Flowever,  supporting  documentation  showed  that4  ofthe  6  audits  had  atleast2  significant 
deficiencies  related  to  noncompliance  with  GAGAS  and  DCAA  policy.  For  example,  auditquality 
reviewers  noted  thatthe  risk  assessment  for  one  assignment  inappropriately  stated  the 
contractor's  accounting  system  was  adequate.  In  addition,  reviewers  stated  that  conclusions  and 
opinions  in  reports  for  three  audits  were  not  based  on  sufficient  evidence.  Reviewers  also  noted 
that  three  audits  had  significant  deficiencies,  including  insufficient  testing,  inadequate 
procedures  to  identify  illegal  acts  and  noncompliance  with  laws  and  regulations,  and  reporting 
problems.  Reviewers  also  found  inaccuracies  in  reporting  on  three  audits  and  stated  that  reports 
on  2  ofthe  audits  should  not  have  been  issued  and  a  reported  qualification  in  the  report  for  the 
third  audit  was  worded  incorrectly  and  implied  that  work  had  been  performed  when  the  related 
assist  audits  had  not  been  completed. 

Eastern 

6  internal  control 
audits 

Onj  une  8,  2004,  DCAA  reported  satisfactory  compliance  by  the  FAO  reviewed.  Flowever, 
supporting  documentation  showed  that  2  of  6  audits  reviewed  had  at  least  2  instances  of 
significant  noncompliance  with  GAGAS  and  DCAA  policy,  including  inadequate  supervision, 
missing  workpapers  on  the  contractor's  control  environment,  and  insufficient  and  incomplete 
workpaper  evidence  to  support  conclusions  in  the  audit  reports. 

North-eastern 

8  forward  pricing 
audits 

0  n  j  une  26,  2003,  DCAA  reviewers  reported  satisfactory  level  of  compliance  by  the  FAO 
reviewed.  Audit  quality  review  documentation  showed  that  reviewers  found  that  6  of  the  8  audits 
had  at  least  2  instances  of  significant  GAGAS  or  DCAA  policy  noncompliance.  For  example,  2 
audits  were  not  adequately  planned  and  4  audits  had  inadequate  supervisory  involvement.  In 
addition,  supervisory  review  was  performed  10  days  after  the  report  was  issued  on  one  audit, 
and  audit  work  did  not  support  the  reported  opinion  on  a  second  audit. 

Source:  GAO  analysis  of  DCAA  documentation. 
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DOD  IG  Peer  Review  Opinion 
on  DCAA’s  Audit  Quality 
Control  System  Is  Inconsistent 
with  the  Underlying 
Deficiencies  Reported 


In  March  2009,  DCAA  officials  advised  us  that  going  forward,  DCAA  plans 
to  report  all  audit  quality  review  findings  along  with  recommendations  for 
corrective  action  and  follow-up  to  assure  that  FAOs  have  taken 
appropriate  corrective  action. 

The  DOD  IG  reported  an  adequate  (“clean”)  opinion  on  DCAA’s  most 
recent  peer  review  results  although  the  reported  evidence  indicated  that 
numerous  audits  had  serious  deficiencies  in  audit  quality.®^  In  conducting 
DOD’s  audit  oversight  review  of  DCAA  audits  for  fiscal  year  2006,  DOD  IG 
audit  oversight  reviewers  considered  the  same  results  of  DCAA’s  internal 
audit  quality  assurance  reviews  that  we  analyzed  and  reviewed  numerous 
additional  audits,  which  also  identified  significant  GAGAS  noncompliance 
as  evidenced  by  DOD  IG  peer  review  findings  and  recommendations. 
Although  the  DOD  IG  report  contained  evidence  of  significant,  systemic 
noncompliance  with  professional  standards  throughout  DCAA  audits  that 
OIG  staff  reviewed,  and  the  IG  report  included  numerous  findings  and 
recommendations  related  to  those  issues,  the  DOD  IG  gave  DCAA  a 
“clean”  peer  review  opinion,®®  concluding  that: 

“In  our  opinion,  the  DCAA  system  of  quality  control  for  audits  and 
attestation  engagements  performed  during  the  FY  ended  September  30, 

2006,  was  designed  in  accordance  with  quality  standards  established  by 
Government  Auditing  Standards  (GAS).  Further,  the  internal  quality 
control  system  was  operating  effectively  to  provide  reasonable 
assurance  that  DCAA  personnel  were  following  established  policies, 
procedures,  and  applicable  auditing  standards.  Accordingly,  we  have 
determined  that  the  DCAA  system  of  quality  control  used  on  audits  and 
attestation  engagements  for  the  review  period  ended  September  30, 

2006,  is  adequate.” 

The  overall  report  conclusion  in  the  DOD  IG  report  is  not  consistent  with 
the  detailed  observations  in  the  report,  which  indicate  numerous 
significant  deficiencies  in  DCAA’s  system  of  quality  control.  Furthermore, 
based  on  DCAA’s  actions  to  rescind  dozens  of  audit  reports®^  related  to  our 


®®  All  10  categories  of  recommendations  in  the  DOD  IG’s  report  related  to  GAGAS 
compliance  problems. 

®®  DOD  Inspector  General,  Oversight  Review:  Review  of  the  Defense  Contract  Audit 
Agency  Quality  Control  System,  Report  No.  D-2007-6-006  (Arlington,  VA:  May  1,  2007). 

®'^  Of  the  80  rescinded  audit  reports,  39  reports  were  issued  in  fiscal  year  2006 — the  period 
covered  in  the  DOD  IG  peer  review  report  on  DCAA. 
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DCAA  Lacks  a  Risk-Based 
Audit  Planning  Approach 


prior  investigation  and  this  audit  and  our  analysis  of  DCAA’s  internal  audit 
quality  review  procedures  and  documentation — all  of  which  relate  to  the 
period  covered  by  the  DOD  IG  peer  review — we  concluded  that  DCAA’s 
quality  control  system  for  the  period  covered  by  the  last  DOD  IG  peer 
review  was  not  effectively  designed  and  implemented  to  provide 
assurance  that  DCAA  and  its  personnel  comply  with  professional 
standards.  The  DCAA  audits  performed  during  fiscal  years  2007  and  2008 
were  performed  under  the  same  policy  guidance  and  production-related 
performance  metrics  as  the  earlier  audits  and  had  the  same  types  of 
GAGAS  noncompliance,  as  indicated  by  DCAA’s  internal  audit  quality 
review  findings  for  audit  reports  issued  in  fiscal  years  2007  and  2008. 

In  the  absence  of  a  risk-based  audit  planning  approach,  DCAA  has 
historically  performed  30,000  to  40,000  audits  annually  to  support 
contracting  community  decisions  on  contract  awards,  administration,  and 
close-out  using  3,000  to  4,000  auditors — an  average  of  about  10  audit 
reports  per  year  for  each  auditor.  The  large  number  of  assignments  has 
contributed  to  the  production-oriented  environment  and  widespread 
problems  we  have  identified  with  audit  quality.  The  failure  to  perform 
quality  audits  leaves  government  contracting  officers  and  disbursing 
officers  with  inadequate  information,  ultimately  putting  taxpayers  at  risk 
of  improper  contract  payments  and  fraud,  waste,  abuse,  and 
mismanagement.  GKO's  Standards  for  Internal  Control  in  the  Federal 
Government^  require  federal  agency  managers  to  identify  and  assess 
relevant  risks  the  agency  faces  from  external  and  internal  sources 
associated  with  achieving  agency  objectives,  such  as  those  defined  in 
strategic  and  annual  performance  plans  developed  under  the  GPRA.  To  do 
this,  management  needs  to  consider  all  significant  interactions  between 
the  entity  and  other  parties  as  well  as  internal  factors  at  the  agency  and 
activity  levels.  The  specific  risk  analysis  methodology  used  can  vary  by 
agency  because  of  differences  in  agency  missions  and  the  difficulty  in 
qualitatively  and  quantitatively  assigning  risk  levels.  For  example,  DCAA 
would  need  to  consider  requirements  in  law  and  federal  regulation  to  audit 
contractor  cost,  price,  schedule,  systems,  and  compliance  with  laws, 
regulations,  cost  accounting  standards,  and  contract  terms.  DCAA  also 
would  need  to  consider  risks  associated  with  contractor  activity  and  the 
materiality  of  contractor  costs.  Once  risks  have  been  identified,  sound 
management  controls  require  that  they  should  be  analyzed  for  their 


GAO,  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIMD-00-21.3.1 
(Washington,  D.C.:  November  1999). 
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possible  effect,  and  management  should  decide  how  to  manage  the  risk 
and  what  actions  should  be  taken. 

A  risk-based  audit  approach  would  help  identify  and  prioritize  which 
audits  are  the  most  important  or  have  the  highest  return  on  investment 
and  determine  what  constitutes  appropriate  testing  for  various  audit  and 
nonaudit  services.  Basing  future  audit  plans  on  historical  DCAA  audit  hour 
data  is  problematic  because  DCAA  has  not  yet  determined  the  time  and 
effort  that  would  be  needed  to  perform  quality  audits.  For  example, 
historical  audit  hour  data  do  not  accurately  reflect  either  the  time  needed 
to  complete  a  quality  audit  or  the  hours  actually  worked  on  various  audits 
because  many  auditors  performed  limited  procedures  or  they  performed 
audit  procedures  on  their  own  time  to  meet  budgeted  audit  hour  metrics. 

In  addition,  some  audits  may  not  be  necessary.  For  example,  we 
concluded  that  3  of  the  37  internal  control  audits  that  we  reviewed  were 
not  necessary.  For  one  of  the  three  audits,  DCAA  could  have  relied  on  the 
audit  of  a  grantee  that  was  performed  under  the  Single  Audit  Act.®'*  DCAA 
agreed  with  our  conclusion.  Two  other  unnecessary  audits  involved 
estimating  systems  of  contractors  that  only  have  one  contract  with  the 
government.  Because  contract  proposals,  which  would  be  tested  as  part  of 
the  estimating  system  audit  for  these  contractors,  are  separately  audited 
when  they  are  submitted,  we  questioned  the  need  for  separate  estimating 
system  audits  for  these  contractors.  DCAA  officials  told  us  they  would 
reconsider  the  need  for  separate  estimating  system  audits  in  such  cases. 

Developing  a  risk-based  audit  approach  that  considers  the  risk  of 
improper  contract  payments  and  available  resources  would  also  be  a  first 
step  in  determining  the  level  of  audit  resources  and  training  needed  to 
accomplish  effective  contract  audits.  In  addition,  determining  appropriate 
roles  and  responsibilities  for  nonaudit  assignments  would  further  clarify 
DCAA  audit  resource  needs  as  well  as  needed  job  skills  and  funding  for 
buying  commands  and  DCMA. 

The  most  pervasive  audit  deficiency  we  identified  was  insufficient  testing 
to  support  DCAA’s  reported  conclusions  and  opinions.  Limited  audit 
testing  was  directly  related  to  DCAA’s  goal  of  performing  30,000  or  more 


Codified,  as  amended,  at  31  U.S.C.  ch.  75.  The  Single  Audit  Act  requires  that  a  state,  local 
government  or  non-profit  organization  that  expends  more  than  $600,000  in  a  fiscal  year 
undergo  a  single  audit,  which  includes  an  audit  of  the  entity’s  financial  statements  and 
Schedule  of  Expenditures  of  Federal  Awards,  as  well  as  testing  of  and  reporting  on  certain 
internal  controls. 
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audit  assignments  annually.  Achieving  a  goal  of  performing  quality  audits 
will  depend,  in  part,  on  appropriate  guidance  on  testing  coupled  with 
adequate  training  and  supervision.  Quality  audits  will  also  be  dependent 
upon  contracting  community  support  of  a  risk-based  audit  approach  and 
an  appropriate  delegation  of  nonaudit  contract  administration  activities 
and  audit  responsibilities  among  DCMA,  buying  commands,  and  DCAA.  As 
noted  above,  DCAA  provides  nearly  all  of  its  services  to  the  contracting 
and  finance  communities  as  GAGAS  audits.  However,  a  risk-based  audit 
approach  may  require  these  commimities  to  re-evaluate  whether  all  such 
services  should  be  provided  as  audits  and  whether  DCAA,  as  an 
independent  audit  organization  would  perform  any  nonaudit  services. 

DCAA’s  deficiencies  in  audit  quality  are  directly  related  to  its  human 
capital  management.  Effective,  efficient  contract  audits  and  oversight  are 
dependent  on  a  workforce  that  has  the  required  skills  to  meet 
organizational  goals  and  perform  quality  audits  that  serve  the  public 
interest,  especially  the  taxpayer.  Both  GAGAS  and  GAO’s  Internal  Control 
Standards^''  require  that  persormel  possess  and  maintain  a  level  of 
competence  that  allows  them  to  accomplish  their  assigned  duties.  GAGAS 
specifically  requires  that  the  staff  assigned  to  conduct  audit  or  attestation 
engagements  under  GAGAS  must  collectively  possess  the  technical 
knowledge,  skills,  and  experience  necessary  to  be  competent  for  the  type 
of  work  being  performed  before  begirming  that  assignment.  GAGAS  also 
requires  attestation  engagements  to  be  properly  supervised.  Accordingly, 
agency  management  has  a  responsibility  to  identify  appropriate 
knowledge  and  skills  needed  for  various  jobs  and  provide  needed  training, 
as  well  as  candid  and  constructive  counseling,  and  performance 
appraisals.  DCAA’s  human  capital  management  practices  of  hiring  auditors 
at  the  entry-level  and  assigning  them  to  complex  audits  with  little 
classroom  training  or  on-the-job  experience  and  minimal  supervision  have 
contributed  to  the  audit  problems  we  identified. 

Inadequate  training  and  supervision.  DCAA  headquarters  officials 
acknowledged  that  the  agency  could  improve  developmental  training  and 
that  it  does  not  have  continuing  training  for  DCAA  auditors  throughout 
their  career,  referred  to  by  DCAA  as  life-cycle  training.  Given  the 


™  GAO-07-731G  §§  3.40  through  3.49,  and  GAO/AIMD-00-21.3.1. 
GAO-07-731G,  §  3.43. 

GAO-03-673G,  §  60.04a,  and  GAO-07-731G,  §  6.04a. 
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complexity  of  contract  audits  and  identified  DCAA  audit  quality  problems, 
timely  and  effective  training  and  appropriate  supervision  are  critical  to 
achieving  effective  audits.  Auditors  also  should  understand  the 
professional  standards  they  are  required  to  follow. 

In  addition,  we  found  that  on-the-job-training  and  supervision,  which  are 
key  components  of  developmental  training,  were  not  consistently  provided 
to  new  auditors.  On-the-job  training  for  new  auditors  varied  by  supervisor 
and  by  DCAA  field  office.  For  example,  we  previously  reported^^  that  one 
of  the  offices  in  our  hotline  investigation  had  addressed  this  training  need 
by  assigning  one  supervisor  to  oversee  trainee  auditors  and  assigning 
trainee  auditors  to  senior  auditors  who  provided  them  on-the-job  training 
during  a  particular  audit.  However,  we  identified  13  CAS  compliance 
audits  at  this  same  office  to  which  trainee  auditors  were  assigned  with 
little  or  no  training  or  supervision.  In  addition,  documentation  for  one  of 
the  team  performance  awards  that  we  recently  obtained  from  this  office 
contained  evidence  that  some  trainee  auditors  were  immediately  given  an 
audit  assignment  to  carry  out  on  their  own.  The  performance  award 
documentation  stated  as  an  achievement  that  “new  hires  were  purposely 
assigned  their  own  assignments  as  early  as  deemed  appropriate  in  order  to 
instill  in  them  early  the  concept  that  they  are  responsible  for  the  planning 
and  conduct  of  their  assigned  audits.  The  supervisory  and  senior 
auditor. .  .made  a  conscious  decision  to  do  this  to  avoid  dependency  issues 
with  the  new  auditors.” 

Our  discussions  with  auditors  in  DCAA’s  5  regions  provide  anecdotal 
examples  of  the  training  problems  we  found.  For  example,  one  auditor 
told  us  that  entry  level  training  is  a  “one-size-fits-all”  approach  that  does 
not  provide  the  right  training  at  the  right  time,  while  four  auditors  told  us 
they  were  not  given  enough  time  to  develop  their  skills.  One  consistent 
comment  from  auditors  was  that  on-the-job  training  was  key  to  auditor 
effectiveness,  but  DCAA  provided  little  or  no  opportunity  for  new  auditors 
to  obtain  this  developmental  experience.  Several  auditors  told  us  that 
trainees  in  their  offices  are  given  assignments  to  do  on  their  own  and  that 
while  trainees  may  work  with  a  senior  level  auditor,  sometimes  these 
senior  auditors  do  not  take  a  leadership  role  that  would  provide  a  learning 
experience  for  trainees.  In  addition,  several  auditors  described  DCAA’s 
internal  training  courses  as  “good,”  but  noted  that  the  courses  covered 
high-level  conceptual  and  technical  information  and  did  not  provide  the 


GAO-08-857. 
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detailed  knowledge  on  how  to  apply  this  information  when  performing  a 
particular  contractor  audit.  Some  FAO  managers  share  this  concern. 

Supervisors  responsible  for  deficient  audits  identified  in  GAO’s 
prior  investigation  were  promoted.  At  the  September  2008  hearing, 
Committee  Members  expressed  concerns  about  DCAA  promotions  of 
supervisors  who  were  responsible  for  improperly  dropped  audit  findings, 
imsubstantiated  changes  in  audit  opinions,  and  abusive  management 
actions  against  whistleblowers  at  locations  covered  in  our  investigation. 
Best  practices  of  leading  organizations  making  organizational  and  cultural 
changes  include  top  leadership  who  set  the  direction,  pace,  and  tone  and 
provides  a  clear,  consistent  rationale  that  unites  staff  together  behind  a 
single  mission.  Agency  management  plays  a  key  role  by  setting  and 
maintaining  the  organization’s  ethical  tone,  providing  guidance  for  proper 
behavior,  removing  temptations  for  unethical  behavior,  and  providing 
discipline,  when  appropriate.  Our  review  of  GAO  hotline  allegations 
received  since  our  investigation  showed  that  meeting  metrics  related  to 
producing  reports  within  budgeted  hours  and  planned  time  frames 
resulted  in  performance  awards  for  auditors  who  performed  deficient 
audits  with  little  or  no  testing  and  lower  performance  ratings  and 
personnel  actions  that  resulted  in  downgrades  and  termination  of  auditors 
who  did  not  meet  these  metrics.  Further,  our  analysis  of  performance 
appraisals  and  performance  award  information  for  auditors  and 
supervisors  at  the  location  in  our  investigation  where  supervisors  had 
been  promoted^^  showed  that  the  supervisory  auditors  responsible  for 
deficient  audits  at  this  location  were  rewarded  with  high  performance 
appraisals,  cash  awards,  and  promotions. 

We  obtained  performance  evaluations  and  performance  award 
documentation  for  auditors  and  supervisors  involved  with  12  audits  that 
had  serious  deficiencies  at  the  first  location  we  investigated  in  our  prior 
work.  The  DCAA  Director  told  us  that  there  are  legal  issues  associated 
with  holding  employees,  such  as  the  supervisory  auditors,  accountable  for 
actions  that  were  identified  after-the-fact.  However,  the  two  supervisory 
auditors  responsible  for  the  deficient  audits  were  approved  for  promotion 
even  though  Western  Region  managers  who  made  promotion  decisions 
were  aware  of  the  GAGAS  compliance  problems.  DCAA’s  Western  Region 
management  had  received  the  DOD  IG’s  January  24,  2007,  memorandum  of 
investigation  covering  10  audits  performed  at  this  location  that  did  not 


GAO-08-857. 


Page  40 


GAO-09-468  DCAA  Audit  Environment 


meet  GAGAS.  Further,  during  the  summer  of  2007,  Region  management 
was  responding  to  issues  identified  in  our  hotline  investigation,  which 
mirrored  the  IG’s  concerns  and  raised  concerns  about  GAGAS  compliance 
with  four  additional  audits.  Despite  these  findings,  we  found  no  evidence 
that  supervisors  and  auditors  who  did  not  follow  GAGAS  and  DCAA  policy 
were  disciplined,  counseled,  or  required  to  take  additional  training. 
Instead,  our  review  of  performance  appraisal  and  awards  documentation 
showed  that  the  supervisors  and  auditors  responsible  for  the  deficient 
audits  received  performance  appraisals  ranging  from  “exceeds  fully 
successful”  to  “outstanding”  along  with  numerous  cash  awards.  One  of  the 
two  supervisors  responsible  for  inappropriate  decisions  to  drop  audit 
findings  and  change  opinions  without  supporting  evidence  was  promoted 
on  October  14,  2007,  and  the  second  supervisor  was  selected  for 
promotion  on  July  25,  2008 — 3  days  after  our  investigative  report  was 
issued.  DCAA  placed  a  hold  on  the  second  supervisor’s  promotion  pending 
further  investigation.  In  addition,  a  senior  auditor  who  dropped  audit 
findings  without  support  at  the  direction  of  the  second  supervisor  was 
promoted  to  a  supervisory  auditor  position  on  January  6,  2008.  In  contrast, 
the  performance  appraisal  of  the  senior  auditor  witness  from  that  office 
who  testified  at  the  Committee’s  September  2008  hearing  was  lowered  two 
levels  from  “outstanding”  to  “fully  successful”  following  the  submission  of 
her  hotline  complaint,  and  she  received  no  cash  awards.  DCAA  has 
rescinded  all  12  audit  reports  and  re-performed  the  12  audits  associated 
with  our  investigation  at  this  field  location. 

Allegations  about  abusive  management  actions  have  continued.  We 

found  that  DCAA’s  current  organization  is  highly  decentralized,  fostering  a 
culture  of  region  autonomy.  Within  this  culture,  DCAA’s  Western  Region 
appears  to  have  continuing  problems  with  unresolved  allegations  of 
abusive  management  actions.  For  example,  21  of  the  34  DCAA  hotline 
allegations  we  received  since  our  July  2008  report,  include  examples  of 
abusive  management  actions,  such  as  auditors  being  penalized  for 
attempting  to  perform  what  they  believe  was  sufficient  testing  to  support 
audit  opinions  and  auditors  not  completing  work  within  established 
timeframes.  Nine  of  these  21  allegations  relate  to  DCAA’s  Western 
Region — ^the  subject  region  in  our  prior  hotline  investigations.  Seven  of  the 
9  allegations  relate  to  current  problems  in  the  Western  Region.  Our  review 


We  spoke  to  the  auditors  and  reviewed  documentation  they  provided.  To  the  extent  that 
the  auditors  also  submitted  complaints  to  DCAA’s  anonymous  Web  site,  we  reviewed 
DCAA’s  handling  of  their  complaints. 
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of  DCAA  anonymous  Web  site  contacts  as  of  the  end  of  May  2007  showed 
that  over  40  percent  (65  of  152)  of  the  DCAA  contacts  also  relate  to  the 
Western  Region,  including  several  that  pertain  to  abusive  management 
actions/®  Although  DCAA  headquarters  officials  have  followed  up  on  some 
of  the  complaints  about  management  abuse  that  they  received,  decisions 
on  disciplinary  or  corrective  action  typically  have  been  delegated  to  region 
management.  DCAA  headquarters  officials  explained  that  in  several  cases. 
Western  Region  management  has  not  agreed  to  take  disciplinary  or  other 
available  corrective  actions.  The  officials  told  us  that  DCAA  hotline  staff 
have  no  recourse  in  these  situations. 


DCAA  Has  Made 
Progress,  but 
Correcting 
Fundamental 
Problems  in  Agency 
Culture  That  Have 
Impacted  Audit 
Quality  Will  Require 
Sustained  Leadership 


Although  DCAA  has  taken  several  positive  steps,  much  more  needs  to  be 
done  to  address  widespread  audit  quality  problems.  DCAA’s  production- 
oriented  culture  is  deeply  imbedded  and  likely  will  take  several  years  to 
change.  Under  the  decentralized  management  environment,  there  has  been 
little  headquarters  oversight  of  DCAA  regions,  as  demonstrated  by 
nationwide  audit  quality  problems.  Further,  DCAA’s  culture  has  focused 
on  hiring  and  promoting  from  within  the  agency  and  most  training  has 
been  conducted  by  agency  staff.  This  has  led  to  a  very  insular  culture 
where  there  are  limited  perspectives  on  how  to  make  effective 
organizational  changes.  In  response  to  our  July  2008  investigative  report, 
DOD’s  former  Comptroller/CFO  and  Defense  Business  Board  (DBB) 
conducted  reviews^®  of  DCAA  operations  and  made  recommendations  for 
corrective  actions.  The  recommendations  of  the  DBB  are  consistent  with 
many  of  the  recommendations  discussed  later  in  this  report.  DCAA  has 
taken  actions  to  revise  performance  metrics,  change  certain  policy 
guidance,  and  obtain  an  independent  organizational  assessment  (staff 
survey);  however,  DCAA  has  not  yet  addressed  the  fundamental 
weaknesses  in  its  mission,  strategic  plan,  audit  approach,  and  human 
capital  practices.  Moreover,  DCAA  actions  to  date  have  focused  on 


™  After  we  provided  our  report  to  DOD  for  comment,  we  received  updated  information  on 
DCAA  anonymous  Web  site  complaints.  As  of  the  end  of  July  2009,  DCAA  had  established 
209  cases.  Eight  of  those  cases  were  immediately  referred  to  the  DOD  IG  for  investigation. 
Of  the  209  cases,  82  were  for  the  Western  Region. 

GAO-08-857. 

Bjised  on  audit  quality  problems  identified  in  our  July  2008  report,  in  August  2008,  the 
DOD  Comptroller/CFO  conducted  a  tiger  team  review  in  August  2008  and  also  asked  the 
Secretary  of  Defense  for  support  in  conducting  a  study  of  DCAA.  With  the  Secretary’s 
approval,  the  DOD  Advisory  Panel  determined  that  the  Defense  Business  Board  would 
perform  this  study. 
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process  and  have  not  addressed  the  agency’s  decentralized  organizational 
structure  that  has  fostered  a  culture  of  DCAA  region  autonomy.  On 
October  23,  2008,  the  DBB  discussed  its  preliminary  findings  and 
recommendations  at  a  public  meeting,  and  on  January  22,  2009,  the  DBB 
released  its  DCAA  study  report,  which  concluded  that: 

•  DCAA’s  mission  focused  primarily  on  supporting  the  procurement 
community  with  no  mention  of  protecting  taxpayer  interest.  The 
current  mission  statement  also  provided  for  advisory  services  that 
raised  serious  questions  about  DCAA’s  independence  and  objectivity 
under  GAGAS. 

•  DCAA’s  strategic  plan  did  not  address  essential  elements  required  by 
GPRA,  and  it  did  not  address  emerging  issues  that  could  affect  mission 
accomplishment  or  contain  a  human  capital  strategic  plan  despite 
spending  80  percent  of  its  budget  on  personnel. 

•  None  of  DCAA’s  24  performance  measures  addressed  audit  quality, 
such  as  conformance  to  GAGAS,  and  only  8  could  be  tied  to  DCAA’s 
strategic  plan. 

•  DCAA’s  decentralized  organizational  culture  dilutes  effectiveness  of 
managerial  oversight  and  affects  GAGAS  compliance  and  audit  quality. 

•  DCAA  has  not  established  a  human  capital  strategic  plan  as  a  key  tool 
to  facilitate  human  capital  management  and  workforce  development  in 
support  of  DCAA’s  mission  and  implementation  of  its  strategic  plan. 


The  following  discussion  summarizes  the  status  of  DCAA  corrective 
actions  on  identified  weaknesses,  including  actions  on  key  DBB  and  DOD 
Comptroller/CFO  recommendations. 


DCAA’s  Mission  Statement  The  DBB  report,  released  in  January  2009,  pointed  out  that  DCAA  had  five 
and  Strategic  Plan  Have  versions  of  a  mission  statement,  noting  that  each  version  focused 
Not  Yet  Been  Revised  primarily  on  supporting  the  procurement  community.  The  Board 

concluded  that  DCAA’s  mission  should  be  refocused  to  protect  the 
taxpayer’s  interests,  writing:  “The  mission  fostered  the  culture  of 
supporting  contracting  officials,  and  the  value  system  was  one  of  quantity 
(number,  cost,  and  timeliness  of  audits)  over  quality. .  .which  was  further 
reinforced  by  the  performance  metrics  that  drove  the  organization.”  In 
addition,  the  Board  reported  that  instead  of  complying  with  GPRA 
strategic  planning  requirements  for  long-term  goals  and  objectives  for 
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The  Secretary  of  Defense  Has 
Not  Yet  Developed  a  DCAA 
Mission  Statement  That 
Focuses  on  Protecting  the 
Public  Interest 


DCAA  Has  Not  Yet  Developed  a 
Strategic  Plan  To  Provide  a 
Framework  for  Organizational 
and  Cultural  Reform 


major  operations  and  functions,  DCAA’s  plan  resembled  a  short-term 
process  improvement  checklist  and  did  not  address  enterprise  risk, 
external  factors,  or  emerging  issues  that  could  affect  mission 
accomplishment.  In  addition,  the  Board  noted  that  DCAA’s  strategic  plan 
did  not  include  an  adequate  human  capital  strategy  to  facilitate  workforce 
development,  recruiting,  retention,  and  succession  planning. 

The  DBB  report  recommended  that  the  Secretary  of  Defense  revise 
DCAA’s  mission  to  focus  on  protecting  the  interest  of  taxpayers,  with  the 
taxpayer  as  the  primary  customer,  and  that  DCAA  establish  a  core  value  of 
performing  high  quality,  independent,  and  objective  contract  audits  that 
adhere  to  GAGAS  and  ensure  that  taxpayer  dollars  are  spent  on  fair  and 
reasonable  contract  prices.  The  DBB  did  not  address  any  amendments  that 
might  need  to  be  made  to  the  FAR,  DFARS,  and  DOD  Directives  and  policy 
documents  that  reflect  DCAA’s  primary  role  as  an  advisor  to  government 
contracting  officers  and  disbursing  officers.™ 

Leading  organizations  that  have  undergone  cultural  and  organizational 
transformation  have  identified  top  leadership  involvement  in  developing  a 
mission  statement  and  strategic  plan  as  a  best  practice.  These 
organizations  consider  top  leadership  commitment  in  setting  the  direction, 
pace,  and  tone  for  the  transformation  as  essential  to  provide  a  clear, 
consistent  rationale  that  unites  agency  components  behind  the  mission  to 
guide  the  transformation.  In  meetings  with  DCAA  officials,  we  expressed 
our  concern  that  the  Secretary  of  Defense  had  not  taken  action  to  revise 
DCAA’s  mission  statement.  On  March  12,  2009,  following  a  discussion  on 
the  preliminary  results  of  our  audit,  the  DCAA  Director  submitted  a 
proposed  revision  to  DCAA’s  mission  statement  to  the  Comptroher/CFO 
for  review.  The  proposed  revision  inserted  phrases  that  refer  to  “..  .serving 
the  public  interest”  and  “...ensure  taxpayer  dollars  are  spent  on  fair  and 
reasonable  contract  prices.”  Although  the  revised  mission  statement  had 
not  been  approved  by  the  Secretary  of  Defense  as  of  the  end  of  July  2009, 
these  changes  would  be  positive. 

The  DBB  also  recommended  that  DCAA  develop  a  strategic  plan  that 
cascades  from  the  revised  mission  statement  and  concurrently  develop  (1) 
an  annual  performance  operating  plan  and  a  balanced  scorecard  tied  to 
the  strategic  plan  and  (2)  a  human  capital  strategic  plan.  In  addition,  the 


™  On  most  contracting  matters  with  DCAA  involvement,  the  cognizant  agency  contracting 
officer  makes  final  decisions  based  on  DCAA’s  findings  £md  recommendations. 
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DBB  recommended  that  DCAA  obtain  an  independent  assessment  of 
resource  needs  and  engage  an  external  professional  organization  to  assist 
in  a  cultural  transformation. 

DCAA  officials  told  us  they  are  having  difficulty  identifying  an 
independent  external  professional  organization  to  assist  the  agency  in 
developing  a  strategic  plan  because  DCAA  audits  most  of  the  organizations 
that  should  be  able  to  provide  this  type  of  assistance.  In  her  February  27, 
2009,  response  to  the  DBB  report,  the  DCAA  Director  stated  that  DCAA 
expects  to  complete  action  on  this  recommendation  by  September  2009. 
With  regard  to  the  recommendation  to  develop  a  balanced  score  card,  the 
DCAA  Director  reported  that  based  on  agreements  with  prior  DOD 
Comptroller/CFOs,  DCAA  plans  to  use  a  monthly  status  report  of  agency 
performance  measures  rather  than  developing  a  balanced  score  card. 
Together  with  the  change  in  performance  measures  for  fiscal  year  2009, 
DCAA  implemented  the  monthly  performance  report  in  October  2008.  The 
DCAA  Director  stated  that  DCAA  will  refine  the  annual  performance  plan 
in  accordance  with  development  of  a  revised  strategic  plan. 

The  DCAA  Director  also  stated  that  DCAA  initiated  a  process  to 
reengineer  its  human  capital  strategic  plan  in  November  2008.  The 
Director  stated  that  DCAA  obtained  example  plans  from  other 
organizations  and  attended  training  on  human  capital  plan  preparation  and 
maintenance.  DCAA  is  also  seeking  assistance  from  external  organizations 
in  reengineering  its  human  capital  plan. 


DCAA’s  Director  Took 
Immediate  Action  To 
Eliminate  Production 
Metrics,  but  Concerns 
about  Audit  Quality 
Measures  Remain 


The  Committee’s  September  2008  DCAA  oversight  hearing  raised  concerns 
that  DCAA’s  performance  metrics  focused  on  producing  reports  rather 
than  performing  quality  audits  and  that  auditors  who  attempted  to  perform 
quality  audits  were  penalized  for  not  meeting  production  goals.  The  DCAA 
Director  acknowledged  problems  with  the  agency’s  metrics  and  stated  that 
she  had  initiated  a  project  to  assess  the  agency’s  use  of  performance 
measures  that  would  be  completed  by  September  30,  2008.  Performance 
metrics  provide  the  basis  for  measuring  achievement  of  agency  mission 
and  strategic  goals.  Accordingly,  performance  measures  should  be 
consistent  with  agency  strategic  goals.  Although  DCAA’s  mission 
statement  and  strategic  plan  have  not  yet  been  revised  to  provide  new 
goals,  the  DCAA  Director  took  action  in  September  2008  to  eliminate 
production-oriented  performance  measures.  On  September  30,  2008,  the 
Director  issued  a  policy  memorandum  that  eliminated  18  performance 
measures,  identified  9  performance  measures  with  goals  for  use  in  fiscal 
year  2009,  and  clarified  the  use  and  level  of  reporting  on  the  revised 
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New  Performance  Metrics 
Intended  To  Focus  on 
Achieving  Quality  Audits 


measures.  Some  of  the  new  performance  metrics  focus  on  outcomes, 
while  others  continue  to  focus  on  producing  low  cost  audits  in  fixed  time 
frames. 

The  DOD  Comptroller/CFO  required  DCAA  to  develop  standard  metrics  to 
measure  and  re-enforce  compliance  with  GAGAS  and  CAM  across  DCAA 
by  February  28,  2009.  The  DCAA  Director  reported  that  the  new  metrics 
established  on  September  30,  2008,  met  this  requirement.  DCAA  identified 
the  following  six  new  performance  metrics  as  focusing  on  the  intended 
outcome-related  goal  of  achieving  quality  audits  that  comply  with 
GAGAS. 

1.  Obtaining  an  unqualified  DOD  IG  peer  review  opinion. 

2.  DCAA’s  internal  quality  assurance  program  results  show  that  100 
percent  of  the  audits  reviewed  reflected  professional  judgment. 

3.  Checklist  confirmation  that  issued  reports  did  not  include  serious 
deficiencies. 

4.  A  goal  that  45  percent  of  audit  reports  will  have  findings  as  an 
indication  of  the  tangible  value  of  the  audit  work  performed. 

5.  A  goal  that  15  percent  of  the  audits  will  use  quantitative  methods  to 
measure  the  extent  to  which  advanced  level  audit  techniques  are  used. 

6.  A  goal  that  auditors  will  meet  100  percent  of  their  continuing 
professional  education  requirements  on  time. 

Only  metrics  number  1,  3,  and  6  have  a  direct  relationship  to  audit  quality. 
Although  metric  number  2  could  improve  audit  quality  if  properly 
implemented,  DCAA  gave  passing  scores  to  deficient  audits.  Given  the 
problems  with  DCAA’s  ineffective  quality  assurance  program  and  DOD  IG 
peer  review  results,  for  these  three  metrics  to  achieve  the  intended  audit 
quality  goal,  significant  changes  will  be  needed  in  policy  guidance  and 
training  on  audit  standards,  appropriate  procedures,  and  audit 
documentation  in  order  to  comply  with  GAGAS.  The  fourth  goal  that  45 
percent  of  DCAA  audit  reports  will  have  findings  is  approximately  the 
same  as  the  actual  percentage  of  41  percent  of  the  reports  in  2008. 

Because  findings  would  support  recommendations  for  corrective  action, 
this  metric  could  contribute  to  improvements  in  accountability  over 
contractor  cost  and  billings.  Regardless  of  the  goal,  findings  should  be 
reported  as  appropriate  based  on  the  completion  of  quality  audits.  Further, 
the  use  of  quantitative  methods  of  analysis  in  audit  reports  needs  to  be 


™  DCAA  also  established  contracting  officer  sustention  rates  related  to  questioned  cost  and 
net  savings  as  an  informational  goal  to  show  return  to  the  taxpayer. 
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Performance  Metrics  That 
Continue  To  Measure  Output 


supported  by  training  on  the  appropriate  methods  for  sampling  and  testing 
contract  costs,  controls,  and  compliance  to  help  auditors  perform 
sufficient  testing  to  support  audit  conclusions  and  opinions. 

Although  three  of  DCAA’s  fiscal  year  2009  metrics  are  important  in  that 
they  address  responsiveness  to  contracting  officer  requests  for  audits,  if 
not  properly  managed,  they  could  impact  the  effectiveness  of  DCAA’s  new 
audit  quality  metrics.  In  the  past,  DCAA’s  efforts  to  meet  contracting 
officer  requests  for  audits  within  specified  time  frames  caused  auditors  to 
sacrifice  audit  quality.  The  following  three  performance  metrics  continue 
to  address  issuing  reports  within  specified  times  to  support  contract 
awards  and  closeouts. 

•  A  forward-pricing  audit  timeliness  goal  of  95  percent  based  on 
agreement  with  requesters. 

•  Incurred  cost  audit  timeliness  goals  of  90  percent  of  corporate  audits 
completed  within  12  months,  90  percent  of  major  contractor  audits 
completed  in  15  months,  and  95  percent  of  non-major  contractor  audits 
completed  in  24  months. 

•  An  efficiency  goal  of  cost  per  direct  audit  hour  of  less  than  $113.45  to 
be  monitored  at  the  agency  level  only. 

It  is  critical  that  agreements  with  the  contracting  community  on  timeliness 
goals  for  forward-pricing  and  incurred  cost  audits  allow  performance  of 
sufficient  audit  procedures  to  help  contracting  officers  ensure  that  prices 
paid  by  the  government  are  fair  and  reasonable,  and  that  contract  costs 
comply  with  applicable  laws,  regulations,  cost  accounting  standards,  and 
contract  terms.  In  addition,  keeping  cost  per  direct  audit  hour  in  line  with 
past  practices  indicates  that  DCAA  likely  would  continue  to  use  trainee  or 
junior  auditors  on  assignments  without  senior  auditor  or  supervisory 
auditor  involvement.  GAGAS  requires  that  staff  assigned  to  perform  the 
audit  or  attestation  engagement  must  collectively  possess  adequate 
professional  competence  for  the  tasks  required.**'  Moreover,  DCAA  has  not 
agreed  to  develop  a  risk-based  audit  approach  to  address  how  it  will 
perform  required  audits  with  available  audit  resources,  reassess  the  need 
to  perform  30,000  or  more  audits  annually,  and  establish  priorities  for 
performing  quality  audits  that  meet  GAGAS  within  available  resources. 


**'  GAO-07-731G,  §  3.40. 
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Inconsistent  Implementation 
and  Training  on  New  Metrics 


On  October  30,  2008,  DCAA  required  regional  audit  managers  to  provide 
training  on  changes  in  performance  metrics  to  all  FAOs  by  December  31, 
2008,  as  part  of  the  effort  to  get  the  word  out  that  DCAA’s  mission  should 
be  to  protect  taxpayer  interest  and  that  auditors  should  perform  quality 
audits  that  meet  GAGAS.  The  DCAA  Director  stressed  to  us  that  budgeted 
audit  hours  would  be  captured  for  planning  purposes,  but  they  were  never 
intended  and  should  not  have  been  used  to  evaluate  auditor  performance. 
The  DCAA  Director  also  told  us  that  DCAA  auditor  performance 
appraisals  should  not  have  considered  exceeding  budgeted  audit  hours  as 
a  performance  failure.  In  addition,  DCAA  implemented  an  anonymous  Web 
site  for  capturing  feedback  on  inappropriate  use  of  the  new  performance 
measures  and  abusive  management  actions. 

During  random  telephone  calls  made  to  17  auditors  across  15  FAOs  in  the 
five  DCAA  regions,  we  found  mixed  results  on  FAO  implementation  of 
DCAA’s  new  performance  metrics.  DCAA’s  Assistant  Director  of 
Operations  told  us  she  also  had  become  aware  of  some  problems  with 
regional  audit  managers  meeting  the  requirement  to  provide  training  to 
FAOs  on  implementation  of  the  new  DCAA  performance  metrics.  The 
Operations  Assistant  Director  told  us  that  she  planned  to  follow-up  with 
all  FAOs  in  this  regard.  In  response  to  our  telephone  calls,  for  example: 

•  Auditors  at  13  of  the  FAOs  told  us  that  metrics  related  to  meeting 
budget  hours  for  completing  audits  have  been  relaxed.  Although  most 
of  these  auditors  were  not  aware  of  audit  completion  dates  in  fiscal 
year  2009  program  plans  for  their  offices,  two  auditors  told  us  that 
audit  completion  dates  had  been  pushed  back  to  allow  more  time  for 
performing  individual  audits.  An  auditor  at  a  Northeast  Region  FAO 
told  us  the  use  of  budget  hours  was  flexible  before  the  metrics 
changes,  so  there  was  no  noticeable  difference.  An  auditor  at  a 
Western  Region  FAO  said  that  although  budget  hours  are  no  longer  a 
metric  for  individual  auditor  performance,  there  is  still  a  lot  of  pressure 
on  auditors  to  meet  budgeted  hours. 

•  Auditors  at  5  of  the  15  FAOs  told  us  they  had  received  the  mandatory 
training  on  changes  in  performance  metrics  prior  to  December  31, 

2008.  However,  auditors  at  4  FAOs  told  us  they  received  the  mandatory 
training  after  December  31,  2008,  including  two  auditors  at  one  Eastern 
Region  FAO  who  told  us  they  did  not  receive  the  required  training  until 
February  13,  2009.  Auditors  at  the  other  6  FAOs  told  us  they  received 
the  metrics  training,  but  they  could  not  remember  the  dates  of  the 
training. 
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•  Auditors  at  5  FAOs  told  us  they  were  permitted  to  charge  from  1  to  2 
hours  of  administrative  time  per  pay  period  for  reading  e-mails  on 
DCAA  policy  changes  and  new  policy  memorandiims.  Auditors  at  2 
FAOs  said  they  were  not  given  an  administrative  code  for  this  purpose. 
One  of  these  auditors  told  us  they  read  the  policies  on  their  own  time. 
Auditors  at  the  remaining  8  FAOs  did  not  mention  a  time  limit  for 
reading  DCAA  policy  memoranda.  DCAA  headquarters  officials  told  us 
that  auditors  should  be  permitted  to  charge  administrative  codes  for 
this  purpose  and  that  they  are  working  to  resolve  this  issue  across 
DCAA. 

The  DCAA  Director  advised  DCAA  employees  that  the  new  performance 
metrics  would  be  revisited  after  6  months  to  determine  if  changes  are 
needed.  On  February  11,  2009,  DCAA  revised  its  fiscal  year  2009  job 
objectives/performance  plans  to  reflect  the  new  performance  measures, 
and  DCAA’s  Deputy  Assistant  Director  of  Operations  advised  us  that 
DCAA  initiated  an  assessment  of  the  new  performance  metrics  in  April 
2009. 


DCAA  Has  Centralized,  but 
Has  Not  Yet  Restructured 
Its  Audit  Quality 
Assurance  Program 


DCAA  has  taken  some  actions  to  improve  its  quality  assurance  program. 
However,  staffing  difficulties  and  other  issues  have  left  the  outcome  of  this 
important  initiative  uncertain.  As  previously  discussed,  GAGAS  require 
that  each  audit  organization  performing  audits  and  attestation 
engagements  in  accordance  with  GAGAS  should  have  a  system  of  quahty 
control  that  is  designed  to  provide  the  audit  organization  with  reasonable 
assurance  that  the  organization  and  its  personnel  comply  with 
professional  standards  and  applicable  legal  and  regulatory  requirements, 
and  have  an  external  peer  review  at  least  once  every  3  years.  In  addition, 
considering  the  large  number  of  DCAA  audit  reports  issued  annually  and 
the  reliance  the  contracting  and  finance  communities  have  placed  on 
DCAA  audit  conclusions  and  opinions,  an  effective  quality  assurance 
program  is  key  to  protecting  the  public  interest.  Such  a  program  would 
report  review  findings  along  with  recommendations  for  any  needed 
corrective  actions;  provide  training  and  additional  policy  guidance,  as 
appropriate;  and  perform  follow-up  reviews  to  assure  that  corrective 
actions  were  taken.  When  we  briefed  DCAA  on  our  preliminary  findings  in 
March  2009,  DCAA  had  not  yet  taken  action  to  correct  serious  deficiencies 
in  its  quality  assurance  program,  including  problems  with  DCAA’s 
application  of  the  professional  judgment  standard,  whereby  quality 


GAO-07-731G,  §§  3.49-3.52. 
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assurance  program  officials  gave  satisfactory  ratings  when  significant 
noncompliance  with  GAGAS  had  been  identified  by  reviewers. 

In  response  to  our  previous  report,  on  August  20,  2008,  the  DOD 
Comptroller/CFO  required  that  DCAA  take  certain  actions  to  improve 
audit  quality,  which  included  a  restructuring  of  DCAA’s  quality  assurance 
function.  Accordingly,  on  August  22,  2008,  DCAA  established  a  new 
headquarters  Directorate  for  Quality  Assurance  and  Integrity,  which 
centralized  the  quality  assurance  function  at  DCAA  headquarters.  The 
DOD  Comptroller/CFO  directed  that  the  new  Quality  Assurance 
Directorate  be  headed  by  a  Senior  Executive  Service  (SES)  Deputy 
Director.  Because  DOD  did  not  grant  DCAA  an  additional  SES  position  for 
this  purpose,  the  DCAA  Director  assigned  responsibility  for  leading 
DCAA’s  quality  assurance  function  to  a  level  GS-15,  Assistant  Director  for 
Integrity  and  Quality  Assurance.  Under  DCAA’s  management  environment 
and  culture,  which  continue  to  foster  autonomous  regions  headed  by  SES- 
level  directors,  the  grade  level  and  experience  of  the  GS-15  equivalent 
Assistant  Director  for  Integrity  and  Quality  Assurance  pose  a  challenge 
when  dealing  with  SES-level  regional  directors,  deputy  directors,  and 
regional  audit  managers.  For  example,  when  presented  with  our  findings 
and  conclusions  that  various  audits  did  not  comply  with  GAGAS,  DCAA 
headquarters  policy  and  quality  assurance  managers  allowed  regions  and 
FAQ’s  to  decide  whether  to  rescind  the  subject  audit  reports.  In  March 
2009,  DCAA  officials  advised  us  that  the  GS-15,  Assistant  Director  for 
Integrity  and  Quality  Assurance  position  is  an  intended  SES  position  and 
that  two  GS-15  Assistant  Directors  will  perform  as  Chief  of  Integrity  and 
Chief  of  Quality  Assurance. 

In  centralizing  the  quality  assurance  program,  DCAA’s  new  quality 
assurance  organization  provides  for  five  GS-14  senior  quality  assurance 
auditors  at  DCAA  headquarters  and  up  to  27  GS-13  quality  assurance 
auditors  in  the  field  assigned  across  the  5  DCAA  regions.  However,  a 
headquarters  requirement  that  all  senior  quality  assurance  staff  relocate  to 
DCAA  headquarters  at  Fort  Belvoir,  Virginia,  resulted  in  all  but  one  of  the 
five  senior  staff  accepting  other  positions  within  DCAA  because  they  did 
not  wish  to  relocate.  It  took  several  months  to  recruit  DCAA  staff  for  the 
senior  quality  assurance  positions  at  DCAA  headquarters.  On  July  10,  2009, 
a  DCAA  headquarters  official  advised  us  that  DCAA  had  selected  staff  to 
fill  the  two  remaining  vacancies,  and  these  staff  would  be  reporting  for 
duty  in  the  next  few  weeks. 

In  response  to  our  concerns  that  DCAA’s  quality  assurance  program  has 
not  resulted  in  audits  that  comply  with  GAGAS,  DCAA  officials  advised  us 
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that  going  forward,  DCAA  will  no  longer  rate  an  FAO’s  overall  compliance 
with  GAGAS  and  DOD  policy.  The  officials  told  us  that  instead,  DCAA 
headquarters  plans  to  (1)  report  the  detailed  results  of  the  audit  quality 
reviews,  (2)  make  recommendations  to  FAOs  for  any  needed  corrective 
actions,  (3)  conduct  follow-up  reviews  for  all  FAOs  with  identified  audit 
deficiencies  to  ensure  that  corrective  actions  are  taken,  and  (4)  provide 
training  and  policy  guidance,  as  appropriate.  If  properly  implemented, 
these  procedures  would  help  to  assure  an  effective  audit  quality  assurance 
program. 


DCAA  Disagrees  with  the 
DBB  Recommendation  for 
a  Risk-Based  Audit 
Planning  Process 


The  DBB  recommended  that  DCAA  establish  a  risk-based  planning 
process  that  expands  DCAA  self-initiated  audits  and  increases  the 
potential  for  identifying  fraud,  waste,  and  abuse,  and  higher  rates  of  return 
to  the  taxpayer  by  April  2009.  The  DBB  intended  for  DCAA  to  audit  any 
and  all  contracts  awarded  by  the  department.  On  February  27,  2009,  in 
responding  to  the  DBB  recommendation,  the  DCAA  Director  stated  that 
(1)  DCAA’s  practice  of  auditing  only  certain  contracts  was  due  to 
regulation  or  statute  and  (2)  absent  the  DCAA  access-to-records  clause  in 
certain  types  of  contracts,  DCAA  has  no  legal  basis  to  obtain  cost  data 
from  a  contractor.  The  DCAA  Director  suggested  that  the  DBB 
recommendation  should  be  directed  to  the  Under  Secretary  for 
Acquisition,  Technology  and  Logistics,  who  oversees  DCMA,  and  not 
DCAA.  The  DCAA  Director  told  us  that  she  believes  that  DCMA  should 
address  this  recommendation  because  DCMA  decides  what  audits  DCAA 
should  perform  to  support  contracting  decisions  and  DCMA  would  need  to 
initiate  action  to  change  audit-related  FAR  requirements. 


Generally,  DCAA,  as  the  agent  of  the  Secretary  of  Defense,  has  authority*® 
to  examine  records  of  (1)  a  contractor  performing  any  cost- 
reimbursement,  incentive,  time-and-materials,  labor-hour,  or  price  re- 
determinable  contracts  and  subcontractors  performing  such  contracts  of 
the  contractor  and  (2)  to  evaluate  the  accuracy,  completeness,  and 
currency  of  certified  cost  or  pricing  data  required  to  be  submitted 
pursuant  to  law,  all  records  of  the  contractor  or  subcontractor  related  to 
the  proposal,  and  discussions  conducted  on  the  proposal,  pricing  of  the 
contract  or  subcontract  or  performance  of  the  contract  or  subcontract. 
This  authority  is  implemented  by  insertion  of  the  Audit  of  Records  clause 
in  solicitations  for  negotiated  contracts. In  addition,  the  Director  of 


“  10  U.S.C.  §  2313  and  §  2306a. 
FAR  §§  52.214-26,  62.215-2. 
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DCAA  may  require  by  subpoena  the  production  of  any  records  of  a 
contractor  that  the  Secretary  of  Defense  is  authorized  to  audit  or  examine. 
While  DCAA  does  not  have  access  to  the  records  of  all  DOD  contractors  or 
statutory  rights  of  access  to  contractor  officials,  we  believe  it  has 
sufficient  authority  to  undertake  a  risk-based  audit  approach  consistent 
with  its  existing  authority.  Therefore,  we  believe  the  DBB 
recommendation  for  DCAA  to  develop  a  risk-based  audit  planning 
approach  is  appropriate.  DOD  acquisition  officials  we  met  with  agree. 
Further,  as  previously  discussed,  a  risk-based  audit  approach  would 
provide  a  basis  for  determining  audit  resource  requirements. 

DCAA  has  selected  the  Army  Force  Management  Support  Agency*^*^  to 
perform  its  staffing  study.  However,  DCAA  is  conducting  a  staffing  study 
as  a  stand-alone  effort  rather  than  performing  the  study  in  concert  with  an 
effort  to  establish  a  risk-based  planning  process.  To  provide  useful 
information  for  decision  making,  it  is  important  that  the  staffing  study  and 
risk-based  audit  planning  approach  are  conducted  as  integrated  efforts.  It 
is  also  important  for  the  DOD  contracting  and  finance  communities  to  be 
involved  in  the  staffing  study  analysis  and  planning  process  because,  as 
discussed  earlier,  a  risk-based  audit  approach  may  require  these 
communities  to  re-evaulate  whether  all  DCAA  services  should  be  provided 
as  audits  and  whether  DCAA,  as  an  independent  audit  organization,  should 
perform  any  nonaudit  services. 

To  address  immediate  staffing  needs,  DCAA  requested  funds  for  additional 
audit  staff  and  training  from  the  Defense  Acquisition  Workforce 
Development  Fund,®®  including  300  positions  for  fiscal  year  2009  and 
another  200  positions  in  2010.  DCAA  received  approval  of  this  request  in 
December  2008.  In  May  2009,  as  part  of  DOD’s  request  for  an  additional 
9,000  positions  for  contract  management  and  oversight,  the  DCAA  request 
was  increased  from  500  to  700  new  positions  that  are  to  be  phased  in  from 


The  Army  Force  Management  Support  Agency’s  mission  includes  providing  requirements 
studies  and  staffing  analysis  as  well  as  determining  whether  organizations  have  the 
appropriate  staff  to  carry  out  their  mission.  The  Army  Force  Management  Support  Agency 
also  provides  services  to  DOD  components. 

®®  Pub.  L.  No.  110-181,  §1706,  122  Stat.  3  (Jan.  28,  2008),  the  National  Defense  Authorization 
Act  for  Fiscal  Year  2008,  authorized  the  Secretary  to  establish  the  Department  of  Defense 
Acquisition  Workforce  Fund,  in  addition  to  other  funds  that  may  be  available,  for  the 
recruitment,  training,  and  retention  of  department  acquisition  personnel.  The  fund  is 
managed  by  the  Under  Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics. 
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fiscal  year  2009  through  2011.®^  As  previously  discussed,  without 
developing  a  risk-based  audit  approach,  it  is  difficult  to  determine  the  level 
of  resources  needed  to  perform  effective,  quality  contract  audits. 

However,  federal  acquisition  and  contract  audit  resources  have  not  kept 
pace  with  the  growth  on  federal  procurements.  As  shown  in  figure  2, 
although  procurement  obhgations  related  to  greater  rehance  on 
contractor-provided  services  and  support  of  the  Global  War  on  Terrorism 
have  more  than  doubled  since  fiscal  year  2002,  DCAA  audit  resources  have 
remained  about  the  same.  In  addition,  contractor  and  subcontractor 
relationships  have  become  more  complex,  increasing  the  complexity  of 
contract  audits.  These  changes  underscore  the  need  for  a  risk-based  audit 
plan  and  assessment  of  auditor  resource  and  training  needs. 


Figure  2:  Comparison  of  DOD  Contract  Obiigations  and  DCAA  Workforce  for  Fiscal 
Years  2002  through  2008 
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Source:  GAO  analysis  of  unaudited  obligations  data  from  the  Federal  Procurement  Data  System  and  acquisition  workforce  data  from 
the  Office  of  Personnel  Management 


According  to  a  DOD  Comptroller  official,  DCAA  will  receive  an  additional  300  positions 
in  fiscal  year  2009  and  additional  200  positions  in  each  of  fiscal  years  2010  and  2011. 
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Although  DCAA  has  undertaken  certain  initiatives  to  improve  the 
effectiveness  of  audits  of  contractor  billings  and  internal  control  systems, 
these  efforts  are  not  targeted  for  completion  until  September  2010  and 
September  2012,  respectively,  and  they  are  not  part  of  a  comprehensive 
audit  strategy  or  framework.  Once  decisions  are  made  on  changes  in 
various  audit  procedures  for  these  audits,  related  audit  guidance  and 
training  would  be  needed  to  help  ensure  the  new  procedures  are 
effectively  implemented. 


DCAA  Issued  Revised 
Policy  Guidance  To 
Address  Auditor 
Independence,  Assure 
Management  Involvement 
in  Key  Decisions,  and 
Address  Audit  Quality 
Issues 


Our  investigation  and  audit  identified  problems  and  concerns  related  to 
auditor  independence,  the  need  for  management  involvement  in  key 
decisions,  and  audit  quality.  In  response  to  our  work,  the  DBB  and  DOD 
Comptroller/CFO  made  several  recommendations  for  DCAA  actions  to 
address  these  concerns.  Specific  DCAA  actions  and  our  assessment 
include  the  following. 

Auditor  independence.  The  DBB  recommended  that  DCAA  address 
advisory-type  (nonaudit)  services  by  (1)  discontinuing  participation  on 
Integrated  Product  Teams  and  Source  Selection  Evaluation  Boards,  both 
of  which  impair  auditor  independence  in  fact  and  appearance  under 
GAGAS;  (2)  reevaluating  the  role  and  number  of  Financial  Liaison 
Advisors  (FLA)  to  ensure  independence  and  objectivity  in  both  fact  and 
appearance;  and  (3)  working  with  the  DOD  acquisition  leadership  to 
explore  alternatives  for  providing  technical  advice  and  support  to  the 
contract  management  community  while  adhering  to  the  auditor 
independence  standards  in  GAGAS. 


The  DCAA  Director  responded  that  DCAA  discontinued  participation  in 
Integrated  Product  Teams  on  August  4,  2008,  and  Source  Selection 
Evaluation  Boards  on  September  12,  2008.  On  November  23,  2008,  DCAA 
realigned  all  FLAs  to  report  directly  to  DCAA  headquarters  and  completed 
an  assessment  of  the  number  of  advisors.  DCAA  is  continuing  to  assess  the 
functions  performed  by  FLAs  to  assure  their  independence.  The  DCAA 
Director  stated  that  if  there  is  a  significant  change  in  the  advisory 
functions,  DCAA  will  initiate  discussions  with  DOD  acquisition  leadership. 
We  support  efforts  to  reevaluate  DCAA’s  nonaudit  advisory  services  given 
the  problems  identified  in  our  investigation.  Although  our  review  of 
DCAA’s  CAM  guidance  found  that  DCAA  had  established  appropriate 
guidelines  to  avoid  independence  issues,  we  found  that  the  auditors  had 
not  followed  DCAA  policy.  According  to  the  DCAA  Director,  the  DBB’s 
primary  concern  is  that  DCAA  participation  in  these  advisory  services 
created  the  appearance  of  a  lack  of  independence. 
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Requirement  for  DCAA  management  involvement  in  key  decisions. 

DCAA  issued  policy  memorandums  requiring  that  (1)  FAO  managers  sign 
all  audit  reports  issued  by  the  FAO;  (2)  auditors  elevate  memorandums  on 
disagreements  with  supervisors  and  FAO  managers  on  draft  audit  opinions 
to  the  highest  level  necessary,  including  the  DCAA  Director,  for  resolution; 
and  (3)  auditors  elevate  problems  in  accessing  contractor  records  to  FAO 
managers,  contracting  officers,  and  regional  offices  for  appropriate 
handling. 

DCAA  action  to  require  FAO  managers  to  sign  all  audit  reports  issued  by 
the  FAO  addresses  concerns  identified  in  our  investigation  that 
supervisors  could  inappropriately  issue  reports  with  adequate  (“clean”) 
opinions  without  review  by  FAO  managers.  Similarly,  the  policy  to  elevate 
disagreements  on  changes  to  audit  opinions  responds  to  findings  in  our 
investigation  that  supervisors  ignored  auditors’  objections  to  dropped 
findings  and  changed  opinions,  and  the  auditors  had  no  opportunity  to 
elevate  their  disagreement  beyond  the  supervisors.  The  access-to-records 
policy  clarified  actions  required  when  auditors  are  denied  access  to 
records  and  required  FAO  managers  to  brief  their  staff  on  the  revised 
guidance.  The  revised  policy  guidance  emphasized  that  auditors  (1)  should 
follow  procedures  for  addressing  denial  of  access  to  records,  which 
include  notifying  the  FAO  manager,  contracting  officer,  and  DCAA  region; 
(2)  take  appropriate  actions  to  effect  a  suspension  or  withholding  of  any 
unsupported  costs  billed  to  the  government  until  the  data  are  received  and 
a  determination  is  made  regarding  the  allowability  of  the  costs;  and  (3) 
question  the  unsupported  costs  in  the  audit  report  if  the  supporting 
documentation  is  not  received  prior  to  the  completion  of  fieldwork. 
Although  our  work  identified  some  access-to-records  problems,  in  these 
cases,  there  was  no  evidence  that  DCAA  supervisors  elevated  the  issue  to 
management  or  to  procurement  officials  to  initiate  enforcement  action,  as 
set  out  in  existing  DCAA  policy. 

Guidance  to  improve  audit  quality.  On  August  6,  2008,  the  DCAA 
Director  requested  that  each  FAO  hold  a  stand-down  day  (where  staff 
were  relieved  of  assigned  duties  to  take  mandatory  training)  to  discuss 
audit  quality  and  the  requirement  to  comply  with  GAGAS  requirements  for 
competence,  integrity,  objectivity,  and  independence  in  performing 
contract  audits.  In  addition,  DCAA  issued  policy  guidance  on  adequate 
audit  documentation  and  testing,  including  the  following  guidance  that 
applied  to  assignments  we  reviewed  for  this  report: 

•  “Workpaper  Documentation  of  Judgmental  Selections” — requires  a 
description  of  the  universe  (population)  from  which  items  are  selected 
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for  testing,  identification  of  items  and  attributes  to  be  tested,  and  an 
explanation  to  support  that  the  judgmental  selection  will  result  in 
adequate  audit  coverage. 

Emphasizing  the  requirement  that  audit  documentation  include  a 
description  of  the  population  used  for  sampling  and  identification  of 
items  and  attributes  to  be  tested  is  appropriate.  However,  the 
requirement  for  an  explanation  in  the  audit  documentation  that  the 
judgmental  selection  will  result  in  adequate  audit  coverage  needs  to  be 
sufficiently  justified.  GAGAS  and  AICPA  standards  require  that 
auditors  document  significant  decisions  affecting  the  audit  objectives, 
scope  and  methodology,  findings,  conclusions,  and  recommendations 
resulting  from  professional  judgment.®® 

•  “Audit  Guidance  for  Annual  Testing  of  Contractor  Eligibility  for  Direct 
Bill,”  which  is  intended  to  determine  whether  continued  reliance  can 
be  placed  on  the  contractor’s  procedures  for  preparation  of  interim 
vouchers.  This  policy  change  clarified  and  consohdated  audit  steps 
related  to  the  contractor’s  comphance  with  contract  provisions,  added 
audit  steps  for  reviewing  vouchers  under  time-and-material  and  labor- 
hour  contracts,  and  removed  the  requirement  to  verify  that  the 
contractor’s  Central  Contractor  Registration  is  current.  The  policy 
memorandum  states  that  this  scope  of  work  performed  does  not 
constitute  an  audit  or  attestation  engagement  under  GAGAS. 

It  is  within  DCAA’s  purview  to  determine  whether  these  procedures 
constitute  an  audit.  However,  because  direct-bill  decisions  present  a 
risk  of  undetected  improper  contract  payments,  prudent  decisions  to 
continue  a  contractor’s  direct-bill  authorization  would  necessarily  be 
based  on  testing  a  statistical  sample  of  invoices®®  and  include  a  review 


®®  GAO-07-731G,  §  3.38  and  AU  §  339.12. 

®®  Disbursing  officers  are  authorized  to  make  payments  on  the  authority  of  a  voucher 
certified  by  an  authorized  certifying  officer,  who  is  responsible  for  the  legality,  accuracy, 
and  propriety  of  the  payment.  31  U.S.C.  §§  3325,  3527(c).  DOD  7000. 14-R,  Department  of 
Defense  Financial  Management  Regulation  (DFMR),  Vol.  5,  Ch.  11  (March  2009),  paras. 
110102,  110203.  In  general,  certifying  officers  designated  in  writing  by  the  agency  are 
financially  liable  for  any  improper,  illegal,  or  incorrect  payment  made,  and  each  payment 
made  must  be  audited  (or  “examined”).  31  U.S.C.  §§  3621(a),  3528(a).  DFMR,  Vol.  5,  Ch.  33 
(April  2005),  para.  330303.  However,  31  U.S.C.  §  3521(b)  authorizes  heads  of  agencies  to 
carry  out  a  statistical  sampling  procedure,  within  certain  parameters,  to  audit  vouchers 
when  the  head  of  the  agency  determines  that  economies  will  result.  Further,  31  U.S.C.  § 
3621(c)  provides  that  certifying  and  disbursing  officials  are  not  liable  for  payments  that  are 
not  audited  if  they  were  made  in  good  faith  under  a  statistical  sampling  procedure.  See  68 
Comp.  Gen.  618  (1989);  also  see  generally,  GAO,  Policy  and  Procedures  Manual  for 
Guidance  of  Federal  Agencies,  title  7,  §§  6.5,  7.4,  and  7.5  (Washington,  D.C.:  May  18,  1993). 
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of  supporting  documentation,  including  documentation  to  confirm  the 
government  received  goods  and  services  noted  on  the  billing  invoice. 
We  confirmed  that  Defense  Finance  and  Accounting  Service  certifying 
officers  rely  on  DCAA  reviews,  and  they  do  not  repeat  review 
procedures  they  believe  to  be  performed  by  DCAA. 


Human  Capital  The  DBB  made  two  recommendations  to  improve  DCAA  human  capital 

Management  and  Cultural  management  and  agency  culture,  namely  that  DCAA  (1)  develop  a  human 
Transformation  capital  strategic  plan  as  a  key  tool  to  facilitate  human  capital  management 

and  workforce  development  and  (2)  engage  an  external  professional 
organization  to  assist  in  a  cultural  transformation  that  includes 
emphasizing  core  values  such  as  quality,  independence,  ethics,  and 
objectivity  rather  than  a  mindset  focused  on  quantity  and  productivity. 
DCAA  has  not  yet  developed  a  human  capital  strategic  plan  as  a  key  tool 
to  facilitate  human  capital  management  and  workforce  development.  In 
May  2009,  DCAA  fmahzed  an  agreement  with  the  Naval  Post  Graduate 
School,  Center  for  Defense  Reform,  for  assistance  on  cultural  reform. 
According  to  GAO’s  Internal  Control  Standards,^  operational  success  is 
possible  only  when  the  right  persormel  for  the  job  are  on  board  and  are 
provided  the  right  training,  tools,  structure,  incentives,  and 
responsibilities.  Accordingly,  management  should  ensure  that  skill  needs 
are  continually  assessed  and  that  the  organization  is  able  to  obtain  a 
workforce  that  has  the  required  skills  that  match  those  necessary  to 
achieve  organizational  goals.  In  addition,  training  should  be  aimed  at 
developing  and  retaining  employee  skill  levels  to  meet  challenging 
organizational  needs;  qualified  and  continuous  supervision  should  be 
provided  to  ensure  that  internal  control  objectives  are  achieved;  and 
performance  evaluation  and  feedback,  supplemented  by  an  effective 
reward  system,  should  relate  employee  performance  to  the  organization’s 
success. 

Lack  of  a  human  capital  strategic  plan.  The  lack  of  a  human  capital 
management  strategic  plan  has  limited  the  effectiveness  of  DCAA’s  hiring, 
training,  and  staff  development  efforts.  DCAA  officials  told  us  they  view 
contract  auditing  as  a  highly  specialized  profession  that  requires 
knowledge  of  acquisition  law  and  regulations  and  government 
procurement  and  contract  management  processes.  As  a  result,  DCAA 
officials  believe  that  auditors  must  be  hired  at  the  entry  level  and  trained 


^  GAO/AIMD-OO-21.3.1. 
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to  perform  contract  audits.  The  officials  also  believe  that  because  DCAA  is 
the  only  contract  audit  agency  in  the  federal  government  and  it  operates 
the  only  federal  contract  audit  training  institute,  DCAA  is  in  the  best 
position  to  train  contract  auditors.  However,  DCAA  is  not  the  only  agency 
that  performs  contract  audits.  Many  IG  offices,  including  the  DOD  IG,  the 
military  service  audit  agencies,  several  executive  agency  IGs,  and  GAO  all 
perform  contract  audits.  Further,  DCAA  has  not  provided  training  that  is 
designed  to  develop  contract  audit  skills  at  successively  higher  levels,  and 
it  has  not  provided  adequate  or  continuous  supervision  of  audit  staff. 
Moreover,  our  work  has  shown  that  performance  evaluations  and 
feedback  have  not  always  related  performance  to  the  agency’s  success,  as 
was  the  case  when  supervisors  who  were  responsible  for  improperly 
dropping  audit  findings  and  changing  draft  audit  opinions  received  high 
performance  evaluations  and  cash  awards. 

At  the  September  2008  hearing,  the  DCAA  Director  acknowledged  the 
need  to  develop  revised  training  to  address  audit  quality  issues.  However, 
it  will  take  considerable  time  to  develop  a  revised  training  program  to 
address  the  range  of  changes  in  audit  policies,  processes,  and  procedures 
for  performing  quality  audits  in  accordance  with  GAGAS.  However,  on 
April  8,  2009,  DCAA  revised  its  Supervisory  Development  Training 
Curriculum  to  emphasize  leadership  skills  and  better  reflect  the  day-to-day 
activities  performed  by  supervisors.  This  revision  was  based  on  feedback 
received  through  DCAA’s  suggestion  program,  anonymous  Web  site 
contacts,  and  focus  groups  and  is  not  based  on  a  study  or  expertise  of  an 
outside  professional  organization.  In  addition,  DCAA  has  begun  a 
reassessment  of  the  2-week  technical  indoctrination  class  for  new  hires. 

Although  it  is  appropriate  to  consider  staff  input  in  developing  training 
courses,  the  development  of  in-house  training  by  agency  personnel  may 
not  result  in  a  design  that  encourages  participants  to  develop  more  critical 
analysis  of  the  underlying  principles  or  ways  to  bring  about  organizational 
change.  Outside  expertise  helps  ensure  that  an  organization  benefits  from 
outside  subject  matter  experts  as  well  as  education  and  training 
professionals  who  have  a  broad  perspective  on  innovative  approaches  to 
best  practices  or  best  learning  design. 

DCAA  has  difficulty  identifying  an  independent  professional 
organization  to  assist  in  cultural  transformation.  According  to  the 
DCAA  Director,  DCAA  faces  challenges  in  engaging  a  professional 
organization  to  assist  with  cultural  change  because  (1)  many  external 
organizations  that  provide  this  service  are  audited  by  DCAA  and  to 
preserve  the  appearance  of  independence  under  the  auditing  standards. 
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DCAA  cannot  engage  organizations  that  it  audits  and  (2)  based  on  initial 
discussions  with  various  organizations,  DCAA  believes  this  effort  could 
cost  from  $1  to  $2  million  or  perhaps  more  and  DCAA  would  need 
additional  fimding  to  pay  for  this  assistance.  However,  based  on  an 
assumption  that  DCAA  would  receive  funding  for  this  effort,  the  Director 
established  a  completion  date  of  January  2010  with  training  of  the 
workforce  potentially  extending  into  fiscal  years  2011  and  2012.  In  the  face 
of  these  challenges,  the  DCAA  Director  took  action  on  three  other 
initiatives  related  to  cultural  change.  The  DCAA  Director  stated  that 
shortly  after  issuance  of  our  July  2008  report,  DCAA  initiated  a  1-  to  2-year 
project  to  accomplish  an  organizational  assessment  using  the  Baldrige 
National  Quality  Program®^  criteria  with  assistance  from  Baldrige  experts 
within  the  Army.  In  addition,  as  required  by  the  DOD  Comptroller/CFO  in 
September  2008,  the  Director  asked  the  Office  of  Persormel  Management 
to  conduct  an  independent  organizational  survey  of  DCAA.  As  previously 
discussed,  to  help  ensure  that  DCAA’s  new  performance  metrics  resulted 
in  appropriate  cultural  change  with  regard  to  the  new  emphasis  on  audit 
quality,  DCAA  established  an  anonymous  Web  site  for  obtaining  feedback 
on  the  inappropriate  use  of  the  performance  measures. 

In  May  2009,  DCAA  asked  the  Naval  Postgraduate  School,  Center  for 
Defense  Reform  to  assist  DCAA  with  cultural  transformation  as 
recommended  by  the  DBB.  The  Center  began  work  in  June  2009  to  help 
DCAA  identify  issues  facing  the  organization  and  develop  an  action  plan. 

Delay  in  reporting  resnlts  of  DCAA’s  organizational  snrvey.  DCAA’s 
independent  organizational  survey  was  completed  during  the  fall  of  2008, 
and  DCAA  officials  said  the  assessment  results  would  be  finalized  in 
March  2009,  but  then  amended  the  date  for  completing  the  assessment  of 
the  survey  results  to  late  July  2009.  Therefore,  the  survey  results  were  not 
available  to  us  for  review. 

DCAA’s  anonymous  Web  site  contacts  underscore  the  need  for  a 
separate  hotline  office.  DCAA’s  anonymous  Web  site  was  established  as 
a  mechanism  for  monitoring  compliance  with  DCAA’s  new  performance 
metrics;  however,  it  has  become  an  internal  hotline,  with  many  auditors 


The  Baldrige  National  Quality  Program  is  named  for  Malcolm  Baldrige,  a  former 
Secretary  of  Commerce,  who  was  a  proponent  of  quality  management  as  a  key  to  national 
prosperity  and  long-term  strength.  The  seven  Baldrige  performance  excellence  criteria  are: 
leadership;  strategic  planning;  customer  and  market  focus;  measurement,  analysis,  and 
knowledge  management;  workforce  focus;  process  management;  and  results. 
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reporting  the  same  issues  as  those  presented  in  hotline  complaints 
received  by  GAO.  The  DBB  report  stated  that  DCAA  would  benefit  from 
the  establishment  of  a  Chief  of  Internal  Review  to  perform  critical 
inspector  general  functions,  such  as  performing  periodic  reviews  and 
evaluations,  serving  as  an  ombudsman  between  staff  and  DCAA 
management,  and  addressing  hotline  complaints.  Instead  of  establishing  a 
separate  Internal  Review  function,  in  March  of  2009,  the  DCAA  Director 
divided  responsibilities  of  its  Operations  Directorate  between  the 
Operations  Assistant  Director  and  Deputy  Assistant  Director  to  provide 
dedicated  staff  to  handle  auditor  concerns  reported  to  the  internal  DCAA 
anonymous  Web  site.  DCAA’s  Assistant  Director  of  Operations  along  with 
a  Division  Chief  and  three  program  managers  were  made  responsible  for 
the  DCAA  hotline  function,  and  the  Deputy  Assistant  Director  of 
Operations  was  given  responsibility  for  day-to-day  operations. 

Our  review  of  DCAA  headquarters  handling  of  DCAA  auditor  concerns  and 
hotline  allegations  sent  to  DCAA’s  anonymous  Web  site  determined  that 
internally  reported  DCAA  auditor  concerns  represent  problems  across  all 
five  DCAA  regions.  As  with  GAO  hotline  complaints,  the  largest  number  of 
problems  reported  to  DCAA’s  anonymous  Web  site  related  to  DCAA’s 
Western  Region.  Our  review  of  DCAA  documentation  and  discussions  with 
auditors  and  DCAA  officials  indicate  that  current  handling  of  internally 
reported  DCAA  auditor  concerns  and  allegations  appears  to  be  timely, 
objective,  and  fact-based.  The  Assistant  Director  of  Operations  has  made 
good  progress  in  establishing  credibility  and  trust  in  the  DCAA  hotline 
function.  It  will  be  important  for  any  future  inspector  general  or 
ombudsman  to  carry  forward  in  this  role.  The  DCAA  Director’s  response 
to  the  DBB  report  did  not  address  the  recommendation  to  establish  a 
Chief  of  Internal  Review.  We  agree  with  the  DBB  recommendation.  It  is 
important  for  DCAA  to  have  a  hotline  function  that  is  separate  from 
management  and  operations.  Currently,  the  Operations  Assistant  Director 
has  been  reassigned  to  handle  this  function  on  a  temporary  basis. 

However,  given  the  size  of  the  DCAA  organization,  the  extensive  number 
of  internal  DCAA  hotline  complaints — which  totaled  about  150  at  the  end 
of  May  2009 — and  the  likelihood  of  continuing  hotline  contacts  that  would 
need  to  be  addressed  as  DCAA  undergoes  its  cultural  transformation,  a 
permanent  internal  review  or  inspector  general  function  is  warranted. 
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Legislative  and  Other 
Actions  To  Improve 
DCAAs  Effectiveness 
and  Independence 


In  addition  to  correcting  the  fundamental  weaknesses  in  mission  and  the 
overall  management  environment  discussed  above,  certain  legislative  and 
other  actions,  such  as  changes  in  organizational  placement,  could  enhance 
DCAA’s  effectiveness  and  independence.  Successful  management 
initiatives  for  cultural  and  organizational  change  in  large  private  and 
public  sector  organizations  can  often  take  several  years  to  accomplish. 
Changing  DCAA’s  organizational  placement  without  first  correcting 
fundamental  weaknesses  in  mission  and  the  overall  management 
environment  would  not  assure  effective  audits.  Given  this  time  frame  and 
pursuant  to  your  request,  we  identified  legislative  and  other  actions  that 
decision  makers  can  consider  to  improve  DCAA’s  effectiveness.  In  the 
short  term.  Congress  could  enhance  DCAA’s  effectiveness  and 
independence  by  granting  DCAA  certain  authorities  and  protections 
similar  to  those  offered  to  presidentially  appointed  inspectors  general 
under  the  Inspector  General  Act  of  1978,  as  amended”^  (IG  Act).  The  IG 
Act  contains  provisions  that  enhance  the  independence  of  presidentially 
appointed  IGs,  including  protections  from  removal  without  congressional 
notification,  access  to  independent  legal  counsel,  public  reporting  of  audit 
results,  rights  to  take  statements  from  contractor  and  other  personnel,  and 
budget  visibility.  These  provisions  would  enhance  the  important  DCAA 
initiatives  currently  under  way.  Continued  monitoring  and  oversight  will 
be  essential  to  assuring  the  successful  implementation  of  DCAA’s 
management  initiatives.  In  the  longer  term.  Congress  could  consider 
changes  in  organizational  placement  after  current  reform  efforts  have 
been  effectively  implemented.  However,  moving  DCAA  as  an  organization 
would  require  careful  analysis  and  planning  before  implementation. 


Short-Term  Legislative  In  addition  to  DCAA  management  reforms  already  under  way  and  our 

Actions  additional  recommendations,  we  identified  certain  legislative  protections 

and  authorities  under  the  IG  Act  that  could  enhance  DCAA’s  effectiveness. 
Legislation  would  be  needed  in  order  to  grant  DCAA  such  protections  and 
authorities. 

Leadership.  The  IG  Act  provides  for  the  President  to  appoint  the  IG,  with 
Senate  confirmation,  at  many  federal  agencies.”^  Under  the  act.  Congress 
must  be  notified  in  advance  of  removing  the  IG,  and  only  Congress  can 


Codified  in  an  appendix  to  Title  6  of  the  United  States  Code  (hereafter  5  U.S.C.  App.). 

The  IG  Act  also  requires  the  heads  of  many  “designated  federal  entities”  to  appoint  an 
inspector  general  for  each  entity.  5  U.S.C.  App.  8G. 
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eliminate  the  office  of  an  IG.  Currently,  the  head  of  DCAA  is  appointed  and 
can  be  removed  by  the  Secretary  of  Defense.  Further,  DCAA  was  created 
and  can  be  reorganized  or  reassigned  by  departmental  order  without 
notice.  IG  Act  protections  Congress  could  grant  to  DCAA  would  therefore 
include  (1)  Senate  confirmation  of  a  presidentially  appointed  DCAA 
Director'*'’  and  (2)  removal  of  the  DCAA  Director  conditioned  on 
congressional  notification.  Specifically,  the  act  provides  that  an 
inspector  general  may  be  removed  from  office  by  the  President  and  any 
removal  is  to  be  reported  to  both  Houses  of  Congress  30  days  prior  to  the 
removal.  In  addition  to  these  IG  Act  protections.  Congress  could  build 
additional  provisions  into  legislation,  to  include  the  following: 

•  Requirements  that  the  DCAA  Director  possess  the  appropriate 
professional  qualifications.  For  example,  provisions  for  appointment  of 
the  DCAA  Director  could  require  selection  from  among  individuals 
who  possess  demonstrated  ability  in  managing  and  leading 
organizations,  specific  accounting  or  auditing  background,  general 
knowledge  of  contract  management,  and  knowledge  of  and  extensive 
practical  experience  in  financial  management  practices  in  large 
governmental  or  business  entities. 

•  A  mandate  permitting  the  DCAA  Director  to  hold  a  renewable  term 
appointment  for  between  5  to  7  years.  Legislation  should  provide  that 
the  DCAA  Director  can  be  removed  only  for  cause  or  other  stated 
reasons.  These  protections  would  allow  the  head  of  DCAA  to  provide 
stability  and  continuity  of  leadership  that  span  presidential 
administrations  and  prevent  removal  except  for  cause  or  other 
disclosed  reasons. 

•  Conflict  of  interest  provisions  for  the  DCAA  Director  and  other  key 
staff  in  addition  to  those  provisions  currently  in  law.  This  would  be 
intended  to  ensure  that  selection  of  the  audit  agency  head  would  not 
involve  a  “revolving  door”  situation  between  contractors  and  the 
contract  audit  agency. 

Access  to  independent  legal  connsel.  The  IG  Act  provides  for 
independent  legal  advice  for  IGs  rather  than  requiring  the  use  of  agency 


“  5  U.S.C.  App.  §  3(a). 
5  U.S.C.  App.  §  3(b). 
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legal  counsel.'’*^  Currently,  DCAA  relies  upon  DOD  legal  counsel.  DCAA 
officials  told  us  that  the  DCAA  Director  has  not  always  been  apprised  of 
legal  decisions  by  DOD  counsel  that  have  impacted  DCAA  operations. 
Further,  according  to  the  DCAA  Director,  the  lack  of  independent  counsel 
led  to  a  situation  where  DOD  attorneys  provided  questionable  legal 
counsel  to  a  DCAA  field  office  supervisor  without  the  DCAA  Director’s 
knowledge.  Obtaining  independent  legal  counsel  would  avoid  conflicts  of 
interest  between  DOD  and  DCAA,  thereby  helping  to  improve  DCAA’s 
effectiveness. 

Budget.  The  IG  Act  requires  separate  budgets  for  Offices  of  Inspector 
General  (OIG)  within  agency  budgets,  allowing  Congress  to  review  IG 
budget  requests  separately.  DCAA  currently  does  not  have  this  protection. 
IGs  that  are  appointed  by  the  President  with  Senate  confirmation  receive  a 
separate  appropriation,  preventing  agencies  from  reprogramming  IG  funds 
to  other  programs  and  activities.  However,  there  is  currently  little  visibility 
of  DCAA’s  budget  because  it  is  funded  under  the  Operations  and 
Maintenance,  Defense-wide  appropriation,  which  includes  numerous  DOD 
agencies,  such  as  the  Defense  Contract  Management  Agency  (DCMA),  the 
Defense  Logistics  Agency,  the  Defense  Finance  and  Accounting  Service, 
and  some  buying  command  activities.  Therefore,  DCAA’s  share  of  annual 
appropriations  is  subject  to  reprogramming,  sometimes  without 
congressional  notification.  According  to  the  DCAA  Director  and 
documentation  provided  by  the  Director  and  Office  of  Comptroller/CFO, 
in  the  past,  DOD  has  reprogrammed  funding  between  DCAA  and  other 
DOD  activities  on  numerous  occasions.  Because  these  reprogrammings 
were  below  the  $15  million  threshold  for  congressional  notification. 
Congress  did  not  have  notice  of  these  funding  decreases  at  the  time  they 
occurred.  For  fiscal  year  2009,  DOD  reprogramming  increased  DCAA’s 
funding  by  $3.5  million.  Legislation  similar  to  the  IG  Act  could  grant  DCAA 
a  separate  budget^^  to  provide  visibility  and  protections  from 
reprogramming  of  funds  to  other  agency  priorities. 

Increased  authority  and  independence.  Legislation  could  strengthen 
DCAA’s  audit  authority  by  providing  the  same  level  of  access  to  records 
and  personnel  available  to  IGs.’*^  Currently,  DCAA  has  statutory  rights  of 


“  5  U.S.C.  App.  §  8F(4)(A). 

5  U.S.C.  App.  §  6(f)Cl). 

5  U.S.C.  App.  §  6(a)(1),  (4),  and  (5). 
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access  to  certain  records  related  to  cost-type  contracts  or  those  that 
contain  cost  and  pricing  data,  but  not  to  contractor  personnel.  As  a  result, 
DCAA’s  subpoena  power  is  limited  to  certain  records  and  does  not  cover 
contractor  personnel.  While  we  recognize  that  DCAA  auditors  have 
ongoing  discussions  with  contractor  personnel,  they  do  not  have  statutory 
authority  to  compel  contractor  officials  to  meet  with  them  and  submit  to 
interviews.  IGs  have  authority,  including  subpoena  power,  to  access  all 
records,  reports,  audits,  reviews,  documents,  papers,  recommendations,  or 
other  material  available  that  relate  to  programs  and  operations  for  which 
the  IG  has  responsibilities.  Further,  IG  subpoena  authority  extends  beyond 
access  to  records  and  documents  in  that  IG  auditors  can  administer  or 
take  an  oath  in  order  to  obtain  information.  Our  discussions  with  DCAA 
auditors  and  reviews  of  audit  documentation  identified  numerous 
instances  where  requests  for  contractor  records  were  not  met.®’’  Obtaining 
increased  access  to  contracting  companies,  especially  their  staff  and 
documentation,  would  be  an  important  provision  to  improve  the 
effectiveness  of  DCAA  audit  staff. 

Reporting  and  oversight  of  andit  resnlts.  The  IG  Act  provides  for 
semi-annual  reports  to  the  agency  head  and  appropriate  committees  of 
Congress  summarizing  results  of  significant  audits  and  investigations. 
DCAA  currently  has  no  external  reporting  requirement,  reducing 
opportimities  for  oversight  and  transparency.  Congress  could  mandate 
some  form  of  external  DCAA  reporting  in  legislation  similar  to  the  IG  Act. 
Moreover,  DCAA  does  not  currently  provide  copies  of  its  audit  reports  to 
other  federal  agencies  that  use  the  same  contractors  that  DOD  uses. 
According  to  the  DCAA  Director,  DCAA’s  appropriations  are  specific  to 
DOD  contractor  audits,  and  unless  federal  agencies  request  and  reimburse 
DCAA  for  audit  services,  DCAA  cannot  provide  them  with  copies  of  its 
audit  reports  even  though  its  DOD  audits  of  systems  and  related  internal 
controls,  cost  accounting  system  compliance,  etc.  may  cover  their 
contractors.  Legislation  could  also  expressly  allow  DCAA  to  provide  audit 
results  to  other  agencies,  a  step  that  would  improve  its  visibility  and 
effectiveness  for  the  government  as  a  whole. 


^  As  noted  previously,  in  these  ceises,  there  was  no  evidence  that  DCAA  supervisors 
elevated  the  issue  to  management  or  to  procurement  officials  to  initiate  enforcement 
action,  as  set  out  in  DCAA  policy. 

““  5  U.S.C.  App.  §  5Ca). 
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Legislation  to  grant  DCAA  similar  protections  and  authorities  as  those 
provided  in  the  IG  Act  could  enhance  reform  efforts  that  are  already  under 
way.  Although  we  found  that  a  lack  of  DOD  Comptroller/CFO  and  IG 
oversight  has  impaired  DCAA’s  effectiveness,  DOD  has  begun  work  to 
provide  improved  oversight  of  DCAA’s  operations.  In  August  2008,  the 
DOD  Comptroller/CFO  conducted  a  “tiger  team”  review  of  DCAA’s  audit 
quality  assmance  program,  and  DOD  approved  a  more  comprehensive 
Defense  Business  Board  (DBB)  study.  The  new  DOD  Comptroller/CFO 
recognized  the  need  for  DCAA  oversight  and  on  March  16,  2009,  approved 
the  charter  for  a  DCAA  Oversight  Committee.  Committee  members  include 
the  Auditors  General  of  the  Army,  the  Navy,  and  the  Air  Force;  the  DOD 
Director  of  Defense  Procurement  and  Acquisition  Policy;  and  the  DOD 
Deputy  General  Counsel  for  Acquisition  and  Technology.  The  Committee 
held  its  first  meeting  in  early  April  2009.  During  May  2009,  the  DCAA 
oversight  committee  members  reviewed  selected  DCAA  audits  and  visited 
a  DCAA  field  office.  In  addition,  the  committee  members  have  indicated 
that  they  plan  to  review  this  report,  our  earlier  investigative  report,  the 
DOD  Comptroller/CFO  “tiger  team”  report,  the  DBB  report,  and  the 
upcoming  DOD  IG  report  that  follows  up  on  issues  from  our  July  2008 
report.  The  committee  plans  to  assess  DCAA  actions  on  recommendations 
in  these  reports  and  identify  any  gaps  for  further  action.  We  note  that 
DCAA  has  already  taken  numerous  actions  to  respond  to  our  initial 
investigative  report  as  well  as  DOD  Comptroller/CFO  and  DBB 
recommendations. 


Long-Term  Legislative  Most  of  the  impairments  to  DCAA  effectiveness  that  we  identified  can  be 

Actions  To  Move  DCAA  addressed  within  DCAA’s  current  organizational  placement.  However,  to 

address  the  Committee’s  interest  in  how  changes  in  DCAA’s  organizational 
placement  could  improve  DCAA  effectiveness  and  independence,  we 
considered  potential  approaches  to  moving  DCAA.  During  the  1980s,  there 
were  numerous  proposals  to  reorganize  DCAA’s  organizational  structure, 
including  legislative  proposals  that  would  have  placed  DCAA  in  the  Office 
of  the  Under  Secretary  of  Defense  (Acquisition),  or  in  the  DOD  Office  of 
Inspector  General  (OIG),  or  placed  only  DCAA’s  post-contract  audits  in 
the  OIG.  We  analyzed  these  proposals  in  an  April  1991  report^''^  and 
concluded  that  they  were  not  workable  because  they  posed  conflict  of 
interest  or  duplication  of  effort  issues. 


GAO,  Defense  Contract  Audits:  Current  Organizational  Relationships  and 
Responsibilities,  GAO/AFMD-91-14  (Washington,  D.C.:  Apr.  3,  1991). 
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Elevating  DCAA  within  DOD 


We  believe  that  it  is  prudent  to  consider  changes  in  organizational 
placement  after  DCAA  has  had  sufficient  opportunity  to  effectively 
implement  current  reform  efforts  necessary  to  address  fundamental 
operational  issues.  Legislation  to  move  DCAA  as  an  organization  would 
require  careful  analysis  and  planning  before  implementation.  Moving 
DCAA  at  this  time  would  be  a  bold  step  with  possible  unintended 
consequences,  and  decision  makers  would  need  to  carefully  weigh  the 
costs  and  benefits  of  moving  DCAA  before  the  fundamental  operational 
issues  are  addressed.  As  discussed  below,  regardless  of  its  ultimate 
placement  in  the  government,  DCAA  still  needs  to  address  the 
fundamental  weaknesses  in  its  mission,  strategic  plan,  metrics,  audit 
approach,  and  human  capital  management. 

Elevating  DCAA  within  DOD  as  a  separate  component  reporting  to  the 
Deputy  Secretary  of  Defense  could  give  more  authority  to  the  DCAA 
Director  and  increase  visibility  of  the  organization  both  within  and  outside 
of  DOD.  Because  DOD  positions  reporting  to  the  Secretary  level  are 
established  by  law,  moving  DCAA  to  the  department  level  would  require 
new  legislation.  To  avoid  any  ambiguities  or  questions  about  whether  the 
Secretary  of  Defense  currently  possesses  the  statutory  authority  to 
transfer  the  supervision  of  DCAA  to  the  Deputy  Secretary,  we  believe 
additional  legislation  that  sets  out  appropriate  relationships  would  be  the 
best  approach.  In  addition,  this  option  would  require  some  level  of 
administrative  change.  For  example,  management  and  oversight  of  the 
contract  audit  function  would  become  the  responsibility  of  Deputy 
Secretary,  a  separate  appropriation  would  need  to  be  established,  and 
some  form  of  periodic  external  reporting  to  Congress  would  be 
appropriate.  We  note  that  authorizing  legislation  to  move  DCAA  could  also 
include  similar  protections  and  authorities  as  those  under  the  IG  Act  if 
these  provisions  have  not  already  been  enacted. 


The  Deputy  Secretary  of  Defense  is  appointed  by  the  President  after  confirmation  by  the 
Senate.  10  U.S.C.  §  132(a).  Among  other  duties  as  assigned  by  the  Secretary  of  Defense  and 
in  statute,  the  Deputy  Secretary  serves  as  the  Chief  Management  Officer  of  the  department 
with  primary  responsibility  for  “effectively  and  efficiently  organiz[ing]  the  business 
operations  of  the  Department  of  Defense.”  Pub.  L.  No.  110-181,  div  A,  title  IX,  §  904(a)(2) 
(Jan.  28,  2008).  In  that  capacity,  the  Deputy  Secretary  is  to  be  assisted  by  a  Deputy  Chief 
Management  Officer,  who  also  is  appointed  by  the  President  after  confirmation  by  the 
Senate,  and  who  supervises  the  Defense  Business  Transformation  Agency.  10  U.S.C.  §§ 
132(c),  192(e). 

Current  provisions  of  law  relevant  to  the  Secretary  of  Defense  establishing  and  assigning 
defense  agencies  and  defense  field  activities  within  the  Office  of  the  Secretary  of  Defense 
include  10  U.S.C.  §§  125(a),  131(b),  191(b),  192(a),  and  194. 
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Establishing  an  Independent, 
Governmentwide  Contract 
Audit  Agency 


Although  this  option  could  enhance  DCAA  auditor  objectivity  and 
independence,  under  this  organizational  placement,  DCAA  would  still 
need  to  resolve  the  management  environment  and  cultural  problems  that 
have  had  a  negative  impact  on  audit  quality,  including  pressure  by 
contractors  and  contracting  officers  on  audit  scope  and  findings, 
conclusions,  and  recommendations.  DCAA  also  would  need  DOD 
commitment  to  strengthening  DCAA’s  contract  audit  function  through 
continued  monitoring  and  oversight.  Leadership  from  the  Deputy 
Secretary  of  Defense  would  be  critical  to  help  DCAA  address  these 
matters.  A  key  factor  will  be  whether  the  Deputy  Secretary  has  the 
necessary  time  to  focus  on  DCAA.  The  amount  of  time  needed  should  be 
less  once  the  fundamental  improvements  are  accomplished. 

Numerous  governmentwide  acquisition  management  reform  efforts  are 
currently  under  way  that  could  impact  the  contract  audit  function.  These 
efforts  include  congressional  oversight  and  reform  legislation  and 
Presidential  direction  on  developing  governmentwide  guidance  for 
reviews  of  existing  contracts  to  identify  contracts  that  are  wasteful, 
inefficient,  or  otherwise  unlikely  to  meet  agencies’  needs,  and  to  formulate 
corrective  action  in  a  timely  manner,  as  well  as  interest  group  studies.  For 
example,  in  the  National  Defense  Authorization  Act  for  Fiscal  Year  2008, 
Congress  created  the  Commission  on  Wartime  Contracting  to  study 
federal  agency  contracting  for  the  reconstruction,  logistical  support  of 
coalition  forces,  and  the  performance  of  security  functions  in  Iraq  and 
Afghanistan.  The  Senate  Committee  on  Homeland  Security  and 
Governmental  Affairs  also  recently  created  a  new  Subcommittee  on 
Contracting  Oversight.  Several  Members  of  the  House  Oversight  and 
Government  Reform  Committee  created  the  Clean  Contracting  Coalition 
to  take  a  similar  governmentwide  approach.  The  House  Oversight  and 
Government  Reform  Committee  also  has  been  very  active  in  this  area.  In 
addition,  the  House  Armed  Services  Committee  established  an  acquisition 
panel  to  evaluate  DOD’s  current  acquisition  system,  analyze  the  root 
causes  of  project  or  program  failures,  and  the  administrative  and  cultural 
pressures  that  acquisition  and  program  personnel  face.  The  House  and 
Senate  Armed  Services  Committees  also  led  the  effort  to  enact  the 
Weapon  Systems  Acquisition  Reform  Act  of  2009,^““  which  requires 
oversight  of  cost  estimation,  systems  engineering,  and  performance 
assessment;  promotes  competition;  and  limits  organizational  conflicts  of 
interest. 


Pub.  Law  No.  111-23,  123  Stat.  1704,  May  22,  2009. 
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On  March  4,  2009,  the  President  issued  a  memorandum  directing  executive 
agencies  to  (1)  increase  the  use  of  fixed-price  contracts,  (2)  enhance  the 
capacity  of  the  acquisition  workforce,  (3)  maximize  competition,  and 
(4)  rationalize  the  choice  of  government  or  contractor  resources  to 
perform  required  services.  In  addition,  the  Federal  Acquisition  Irmovation 
and  Reform  Institute — a  nonpartisan,  nonprofit  organization  led  by  leaders 
in  acquisition  and  supply  management — has  called  for  acquisition 
workforce  reforms,  including  a  single  acquisition  job  series  that 
encompasses  at  a  minimum,  three  functions — program  management, 
contracting,  and  a  new  function  called  requirements  management — and  is 
considered  a  professional  “super  COTR”  (contracting  officer’s  technical 
representative)  position.  Over  the  next  several  years,  these  reform 
initiatives  likely  will  have  a  significant  impact  on  government  contracting, 
including  the  roles  and  relationships  of  contract  auditors  and  the 
contracting,  program,  and  finance  communities. 

Depending  on  the  outcome  of  the  various  contract  reform  initiatives  and 
the  successful  implementation  of  DCAA  management  reforms.  Congress 
may  also  want  to  consider  increasing  the  efficacy  of  these  reforms  by 
establishing  an  independent  governmentwide  contract  audit  agency.  The 
creation  of  a  statutory  govemmentwide  contract  audit  agency  could 
enhance  contract  auditor  effectiveness  and  independence  by  placing  the 
audit  agency  outside  DOD  and  other  federal  agencies  that  make 
procurement  and  contract  management  decisions.  Centralizing  the 
contract  audit  function  and  mandating  its  use  by  all  federal  agencies  also 
could  provide  for  consistent  audit  coverage  and  bring  efficiencies  and 
economies  of  scale  to  the  contract  audit  process  across  the  government. 
However,  this  would  likely  entail  significant  costs  and  operational  and 
accountability  considerations  and  would  be  an  extremely  costly  option 
involving  significant  infrastructure  and  reorganization  and  would  require 
substantial  planning  and  analysis  before  deciding  whether  to  proceed  and 
how  to  implement  any  changes.  Some  of  the  issues  that  would  need 
further  study  and  analysis  include  the  following: 

Governance.  Governance  is  the  framework  of  rules  and  practices  by 
which  a  governing  body,  such  as  a  board  of  directors,  ensures 
accountability,  fairness,  and  transparency  in  the  entity’s  relationship  with 
all  of  its  stakeholders,  including  management,  employees,  and 
government.  In  order  to  improve  governance  and  accountability  at  federal 
agencies,  a  variety  of  laws  covering  a  range  of  management  and 
administrative  practices  and  processes  have  been  enacted.  Consideration 
of  such  provisions  for  a  govemmentwide  contract  audit  agency  should 
include  application  of  general  laws  related  to  funds  control,  performance 
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and  financial  reporting,  accounting  and  internal  control  systems,  human 
resources  management,  and  recordkeeping  and  access  to  information, 
among  others.  Further,  governance  issues  unique  to  a  contract  audit 
agency,  such  as  its  relationships  to  agency  contracting  officers  and  the 
Congress,  should  be  assessed. 

Scope  of  Work.  Scope  of  work  considerations  would  include  roles, 
responsibilities,  and  relationships  of  the  govemmentwide  contract  audit 
agency  and  IGs  with  regard  to  contract  audits.  Another  consideration 
would  be  whether  the  new  agency  would  be  available  for  consultation  as 
an  outside  expert  on  federal  agency  pre-award  issues.  In  addition,  a 
determination  would  need  to  be  made  on  the  handling  of  fraud  referrals. 
For  example,  the  central  new  agency  could  have  an  investigative  division 
or  it  could  refer  potential  contract  fraud  to  federal  agency  IGs  for  further 
investigation. 

Funding.  Congress  would  need  to  determine  how  to  fund  the  new 
contract  audit  agency.  For  example,  fimding  could  be  provided  through 
appropriations  or  from  reimbursement  by  federal  agencies.  This  decision 
would  likely  be  tied  to  decisions  on  the  govemmentwide  contract  audit 
agency’s  mandate  and  scope  of  work  and  any  realignment  of  contract 
audit  resources. 

Further  study  and  analysis  of  this  option  would  involve  input  from  the 
federal  agency  IGs  and  agency  contracting  and  finance  communities  as 
well  as  government  contractors  and  public  interest  groups.  Numerous 
additional  issues  would  potentially  be  identified  and  require  substantial 
time  and  cost  for  effective  consideration  and  resolution. 


Conclusions 


Successful  accomplishment  of  DCAA  reforms  will  require  focused  and 
committed  leadership  at  the  highest  levels  of  DOD  and  DCAA  as  well  as 
fundamental  changes  in  DCAA’s  culture  and  possible  congressional  action. 
Without  leadership  commitment  to  a  strong  contract  audit  function  and 
substantial  changes  to  DCAA’s  mission,  strategic  plan,  and  management 
environment  and  culture,  DCAA  will  continue  to  be  challenged  in  its 
ability  to  perform  quality  audits  that  protect  the  public  interest.  Many 
needed  changes  are  planned  or  under  way  and  can  be  completed  in  the 
short-term,  including  revising  DCAA’s  mission  statement,  strategic  plan, 
and  monitoring,  and  adjusting  performance  metrics.  Fimdamental 
structural  and  cultural  changes  related  to  developing  and  implementing  a 
comprehensive,  risk-based  approach  for  contract  audits  that  comply  with 
professional  auditing  standards  and  identifying  staffing,  training,  and 
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resource  needs  will  take  several  years  to  accomplish  and  implement. 
However,  unless  the  overall  problems  with  DCAA’s  culture  and 
management  environment  that  resulted  in  pervasive  contract  audit  failures 
are  resolved,  billions  of  taxpayer  dollars  will  continue  to  be  at  risk  for 
fraud,  waste,  abuse,  and  mismanagement. 


We  are  making  15  recommendations  to  the  Secretary  of  Defense  to 
improve  the  quality  of  the  agency’s  audits  and  strengthen  auditor  integrity, 
objectivity,  and  independence,  including  recommendations  for  actions  on 
findings  in  this  report  that  are  aligned  with  certain  Defense  Business 
Board  (DBB)  findings  and  recommendations. 

First,  we  recommend  that  the  Secretary  of  Defense  revise  DCAA’s  mission 
statement  to  reflect  the  need  for  quality  contract  audits  and  related 
nonaudit  services  that  take  into  account  serving  the  public  interest. 

We  also  recommend  that  the  Secretary  of  Defense  require  the  Under 
Secretary  of  Defense  (Comptroher/CFO)  to  establish  milestones  for 
completing  DCAA  corrective  actions  and  monitor  and  regularly  report  on 
DCAA  progress  to  assure  timely  completion  of  critical  actions. 

In  addition,  we  recommend  that  the  Secretary  of  Defense  direct  the  Under 
Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the 
Defense  Contract  Audit  Agency  (DCAA)  to  take  the  following  13  actions. 

The  following  five  recommendations  cover  actions  to  address  our  findings 
that  are  similar  to  DOD  Comptroher/CFO  and  DBB  findings. 

•  In  concert  with  the  revised  mission  statement,  develop  a  strategic  plan 
with  short-term  and  long-term  outcome-related  goals. 

•  To  measure  progress  in  achieving  strategic  goals,  ensure  that  metrics 
are  tied  to  the  revised  mission  statement  and  strategic  plan  and 
support  the  agency’s  annual  work  plan. 

•  Consult  with  DOD  stakeholders  and  engage  outside  experts  to  develop 
a  risk-based  contract  audit  approach  that  identifies  resource 
requirements  and  focuses  on  performing  quality  audits  that  meet 
generally  accepted  government  auditing  standards  (GAGAS). 


Recommendations  for 
Executive  Action 
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•  Establish  an  SES-level  position  with  responsibility  for  audit  quality 
assurance  that  requires  demonstrated  knowledge  and  experience  in 
applying  professional  audit  standards. 

•  Consistent  with  DBB  report  observations,  establish  a  separate  DCAA 
internal  review  organization  to  conduct  critical  internal  inspector 
general  functions,  including  performing  periodic  internal  evaluations 
and  reviews  and  addressing  DCAA  hotline  complaints. 

The  following  eight  recommendations  relate  to  specific  GAO  findings  in 

this  report. 

•  In  consultation  with  DOD  stakeholders,  review  DCAA’s  current 
portfolio  of  audit  and  nonaudit  services  to  determine  if  any  should  be 
transferred  or  reassigned  to  another  DOD  agency  or  terminated  in 
order  for  DCAA  to  comply  with  GAGAS  integrity,  objectivity,  and 
independence  requirements. 

•  Based  on  the  risk-based  audit  approach,  develop  a  staffing  plan  that 
identifies  auditor  resource  requirements  as  well  as  auditor  skill  levels 
and  training  needs. 

•  Establish  a  position  for  an  expert  on  auditing  standards  or  consult  with 
an  outside  expert  on  auditing  standards  to  assist  in  revising  contract 
audit  policy,  providing  guidance  on  sampling  and  testing,  and 
developing  training  on  professional  auditing  standards. 

•  Revise  DCAA  audit  policy  to  provide  appropriate  guidance  on  what 
constitutes  sufficient  testing  to  comply  with  GAGAS.  Update  DCAA’s 
Contract  Audit  Manual,  as  appropriate. 

•  Develop  agencywide  training  on  government  audit  standards.  This 
training  should  emphasize  the  level  of  assurance  intended  by  the 
various  types  of  engagements  and  provide  detailed  guidance  on  auditor 
independence,  planning,  fraud  risk,  level  of  testing,  supervision, 
auditor  judgment,  audit  documentation,  and  reporting. 

•  Conduct  a  comprehensive,  independent  review  of  DCAA’s  revised  audit 
quality  assurance  function.  This  review  should  focus  on  the  consistent 
application  of  criteria  used  for  assessing  audit  quality  and  assuring 
timely,  consistent,  and  appropriate  reporting  of  review  results. 

•  Make  appropriate  recommendations  to  address  annual  quality 
assurance  review  findings  of  serious  deficiencies  and  GAGAS 
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noncompliance,  provide  training,  and  follow-up  to  assure  that 
appropriate  corrective  actions  have  been  taken. 

•  Establish  policies  and  procedures  to  ensure  that  auditors  who  make 
direct  bill  decisions  are  independent  of  DCAA  employees  who  perform 
a  DOD  management  function  by  reviewing  vouchers  of  contractors  not 
eligible  for  the  direct  billing  program,  thereby  reducing  situations 
where  DCAA  auditors  are  encouraged  to  reduce  their  office  workload 
by  approving  contractors  for  the  direct-bill  program. 

Further,  we  recommend  that  the  Department  of  Defense  Inspector  General 

take  the  following  two  actions. 

•  Reconsider  its  overall  conclusions  in  the  May  2007  DOD  IG  report  on 
the  audit  of  DCAA’s  quality  control  system  in  which  it  reported  an 
adequate  (“clean”)  opinion  on  DCAA  system  of  quality  control  in  light 
of  the  serious  deficiencies  and  findings  included  in  that  report  and  the 
additional  evidence  identified  in  our  audit. 

•  Based  on  the  above,  determine  whether  the  report  should  be  rescinded 
or  modified. 


Matters  for 

Congressional 

Consideration 


In  addition  to  our  recommendations  to  DOD  for  improving  DCAA  audit 
quality  and  auditor  objectivity,  integrity,  and  independence.  Congress  may 
wish  to  consider  the  following  legislative  actions  for  enhancing  DCAA’s 
effectiveness  and  independence.  In  considering  these  options,  the 
Congress  would  need  to  weigh  DCAA’s  ability  to  accomplish  significant 
reforms  within  its  current  environment  and  the  cost  and  administrative 
effort  involved  with  the  alternative  options  along  with  the  potential 
benefits.  Timing  would  also  need  to  be  considered,  given  significant 
reforms  that  DCAA  is  already  undertaking  and  the  additional  burden  that  a 
change  in  organizational  placement  would  add  at  this  time. 

•  In  the  short  term,  as  DCAA  makes  progress  in  correcting  fundamental 
weaknesses  that  have  impacted  audit  quality.  Congress  could  consider 
enhancing  DCAA  reform  efforts  by  enacting  legislation  to  grant  it 
protections  and  authorities  similar  to  those  embodied  in  the  Inspector 
General  Act,  as  amended. 

•  In  the  medium  term.  Congress  could  consider  elevating  the  contract 
audit  function  within  DOD  by  moving  DCAA  from  under  the  DOD 
Comptroller/CFO  and  placing  it  under  the  Deputy  Secretary  of 
Defense. 
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•  In  the  longer  term,  depending  on  the  outcome  of  acquisition 

management  reform  initiatives  under  way  and  the  success  of  DCAA 
management  reforms,  Congress  could  consider  creating  an 
independent,  govemmentwide  contract  audit  agency.  Legislation  to 
move  DCAA  should  incorporate  the  protections  and  authorities  similar 
to  those  embodied  in  the  Inspector  General  Act,  if  these  have  not 
already  been  granted  to  DCAA. 


Agency  Comments 
and  Our  Evaluation 


We  made  a  total  of  17  recommendations,  including  15  recommendations  to 
DOD  to  improve  DCAA’s  management  environment,  audit  quality,  and 
oversight;  and  we  made  2  recommendations  to  the  DOD  IG  regarding 
DCAA’s  last  peer  review.  We  received  written  comments  from  the 
Department  of  Defense  (DOD)  on  September  8,  2009,  and  we  received 
written  comments  from  the  DOD  Inspector  General  (IG)  on  September  3, 
2009.  DOD  stated  that  the  department  concurs  with  all  but  one  of  our  15 
recommendations.  DOD  also  stated  that  the  Department  and  DCAA  are 
committed  to  taking  the  necessary  corrective  actions  to  address  our 
findings  and  that  the  department  will  continue  to  monitor  DCAA  to  ensure 
timely  completion  of  critical  actions  to  address  our  recommendations. 
DOD  also  provided  comments  on  our  matters  for  congressional 
consideration.  Although  DOD  disagreed  with  the  matters  we  discussed,  we 
continue  to  believe  these  are  valid  matters  for  congressional 
consideration.  The  DOD  IG  concurred  with  our  recommendation  to 
reconsider  the  conclusions  in  its  May  2007  peer  review  report  on  DCAA; 
the  IG  did  not  concur  with  our  recommendation  to  determine  whether  to 
rescind  or  modify  its  peer  review  report.  DOD’s  written  comments  are 
reprinted  in  appendix  IV,  and  the  DOD  IG’s  written  comments  are 
reprinted  in  appendix  V.  We  summarize  and  evaluate  the  DOD  and  DOD  IG 
comments  and  responses  to  our  recommendations  below.  We  made 
technical  corrections  and  clarifications  suggested  by  DOD  in  the  body  of 
our  report,  where  appropriate. 


DOD  Comments  and  Our 
Response 


DOD’s  written  comments  include  (1)  comments  on  our  15 
recommendations,  (2)  comments  on  matters  we  presented  for 
congressional  consideration,  (3)  a  list  of  DCAA  corrective  actions, 

(4)  DCAA  clarifications,  and  (5)  comments  from  the  Director,  Defense 
Procurement  and  Acquisition  Policy.  DOD  officials  fully  concurred  with  13 
of  our  15  recommendations  for  improving  DCAA  audits,  partially 
concurred  on  one  recommendation,  and  did  not  concur  with  one 
recommendation.  We  view  DOD  comments  as  being  generally  responsive 
to  the  intent  of  our  recommendations.  Our  discussion  of  DOD’s  response 


Page  73 


GAO-09-468  DCAA  Audit  Environment 


to  our  matters  discussion  and  our  findings  and  recommendations  follow. 
We  provide  additional  comments  on  specific  sections  of  the  DOD  response 
letter  in  appendix  IV. 

With  regard  to  the  matters  we  presented  for  congressional  consideration, 
DOD  stated  that  it  generally  opposes  providing  DCAA  with  authorities 
similar  to  those  contained  in  the  Inspector  General  Act.  DOD  stated  that  it 
specifically  opposes  certain  recommendations  based  on  the  IG  model  if 
DCAA  remains  within  DOD,  including  (1)  a  Presidentially-appointed  and 
Senate-confirmed  DCAA  Director,  unless  DCAA  is  independent  of  DOD, 

(2)  fixed  terms  for  the  DCAA  Director,  (3)  an  independent  budget,  and  (4) 
mandatory  public  reporting.  DOD  also  stated  that  it  plans  to  take  steps  to 
strengthen  DCAA’s  independence  by  establishing  an  appeals  process  that 
permits  DCAA  to  seek  resolution  when  there  are  differences  of  opinion  as 
to  the  resolution  of  its  audit  findings.  Finally,  DOD  opposes  moving  DCAA 
from  under  the  DOD  Comptroller/CFO  and  placing  it  under  the  Deputy 
Secretary.  DOD  pointed  out  that  the  Deputy  Secretary  is  the  Chief 
Management  Officer  of  one  of  the  world’s  largest  organizations  and  backs 
up  the  Secretary  in  the  wartime  chain  of  command,  and  he  does  not  have 
the  time  to  provide  oversight  and  support  to  individual  defense  agencies. 

Although  DOD  did  not  agree  with  these  matters,  we  believe  they  provide 
important  information  for  Congress  to  consider.  For  example,  the 
Inspector  General  Act  provides  many  important  authorities  and 
protections  for  IG’s  that  could  enhance  DCAA’s  independence  and 
effectiveness.  DOD  disagreed  with  the  Presidential  appointment  and 
Senate  confirmation  provision  because  it  believes  this  would  inject  a 
political  element  into  DCAA  that  is  not  appropriate  and  could  create 
lengthy  periods  where  there  is  no  Director.  DOD  also  opposes  fixed  terms 
for  the  DCAA  Director  because  it  believes  the  Secretary  of  Defense  must 
have  the  ability  to  choose  an  appropriate  Director.  Our  position  with 
regard  to  appointments  of  IGs  has  been  that  Presidential  appointments 
with  Senate  confirmation  enhance  their  independence  from  the  entities 
they  audit  and  investigate.  We  recognize  that  DCAA  serves  a  different  role 
than  IGs.  We  looked  to  the  IG  Act  model  to  identify  provisions  that 
enhance  the  independence  of  auditors.  A  political  appointment  would 
elevate  the  status  of  the  Director  among  DCAA’s  stakeholders  and,  as  a 
consequence,  give  DCAA  more  authority  to  respond  to  actions  taken  by  its 
stakeholders  to  influence  its  independent  audit  work.  A  fixed  term  would 
provide  stability,  especially  during  a  time  of  organizational  change.  DOD 
also  questioned  the  wisdom  of  an  independent  budget  because  it  would 
limit  its  ability  to  move  money  into  DCAA,  as  is  occurring  now  based  on 
funding  from  the  Defense  Acquisition  Workforce  Development  Fund. 
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Separate  appropriations  are  a  key  independence  provision  for  IGs.  The 
ability  to  reprogram  funds  within  the  Defense-wide  Operations  and 
Maintenance  appropriation  can  involve  both  increases  and  decreases.  Our 
analysis  of  DCAA  reprogrammings  over  the  last  three  years  showed  that 
funds  were  also  moved  from  DCAA  to  other  DOD  organizations  within  the 
Defense- wide  operations  and  maintenance  appropriation.  In  DCAA’s  case, 
the  reprogrammings  to  reduce  funding  generally  related  to  large 
unobligated  balances — showing  that  DCAA  under  executed  its  budget.  We 
believe  this  is  important  information  that  Congress  would  want  to  know. 
Further,  we  do  not  see  a  reason  why  DOD  could  not  receive  approval  to 
transfer  funds  to  DCAA  from  another  fund  if  it  had  a  separate  budget.  For 
example,  providing  DCAA  with  funds  from  the  Defense  Acquisition 
Workforce  Development  Fund  constitutes  a  transfer  (not  a 
reprogramming),  the  authority  for  which  is  provided  in  the  legislation 
governing  the  Fund,  10  U.S.C.  §  1705(e).  DOD  also  opposed  mandatory 
public  reporting  by  DCAA.  We  believe  that  periodic  reporting  to  Congress 
and  the  public  on  the  results  of  DCAA’s  work  will  enhance  accountability 
over  DCAA.  As  discussed  in  our  report,  DCAA  needs  time  to  address  the 
fundamental  weaknesses  in  mission  and  the  overall  management 
environment.  However,  if  DCAA  is  not  successful  in  resolving  these 
problems  under  its  current  organizational  placement,  it  will  be  necessary 
to  consider  additional  actions.  In  this  regard,  it  may  be  worthwhile  to 
consider  elevating  DCAA  as  a  component  agency  reporting  to  the  Deputy 
Secretary  because  this  could  enhance  DCAA's  independence  by  providing 
it  more  authority  within  DOD  and  increase  DCAA's  visibility  both  within 
and  outside  of  DOD. 

DOD  partially  concurred  with  our  recommendation  that  DCAA  consult 
with  DOD  stakeholders  and  engage  outside  experts  to  develop  a  risk- 
based  contract  audit  approach  that  identifies  resource  requirements  and 
focuses  on  performing  quality  audits  that  meet  GAGAS.  DOD  stated  that 
DCAA  already  has  a  risk-based  contract  audit  approach  in  identifying 
resource  requirements  and  considers  audit  risk  in  planning  various 
assignments.  DOD  stated  that  DCAA  will  coordinate  with  the  Under 
Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics  (USD 
(AT&L))  to  assess  DCAA  audit  requirements.  DOD  also  noted  that  one  of 
DCAA’s  cultural  transformation  projects  is  identifying  and  resolving 


The  USD(AT&L)  is  responsible  under  10  U.S.C.  §  133  for  establishing  DOD  policies 
related  to  the  negotiation,  award,  and  administration  of  contracts,  such  as  those  related  to 
the  use  of  contract  audit  services,  and  for  coordinating  contract  audit  activities  within 


DOD. 
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differing  stakeholder  expectations  while  ensuring  DCAA  performs  quality 
audits  that  meet  GAGAS.  DOD  expects  to  complete  its  assessment  of 
stakeholder  needs  based  on  regulatory  and  statutory  requirements  by 
December  2010.  We  appreciate  these  steps;  however,  we  remain 
concerned  that  DCAA’s  current  approach  of  performing  30,000  to  35,000 
audits  and  issuing  over  22,000  audit  reports  with  3,600  auditors 
substantially  contributed  to  the  widespread  audit  quality  problems  we 
identified.  Generating  that  many  reports  and  doing  that  many  audits  with 
3,600  auditors  leaves  very  little  time  to  perform  in-depth,  complex  audits 
of  contractors.  While  the  Director  of  Defense  Procurement  and  Acquisition 
Policy  commented  that  contract  audits  need  to  be  completed  “in  time  to  be 
useful,”  to  assure  timely,  quality  audits,  DCAA  will  need  a  risk-based 
approach  to  determine  the  appropriate  level  of  audit  and  nonaudit  effort 
and  staffing. 

DOD  did  not  concur  on  our  recommendation  to  develop  policies  and 
procedures  related  to  direct-billing  decisions,  stating  that  (1)  the 
department  believes  that  a  review  of  the  contractor’s  interim  public 
vouchers  is  an  integral  function  of  DCAA’s  continual  assessment  of  a 
contractor’s  billing  system  (2)  DCAA  is  in  the  best  position  to  review  and 
approve  contract  interim  billings  based  on  its  thorough  understanding  of 
the  contractor’s  system,  (3)  DOD  believes  that  our  concerns  are  mitigated 
based  on  the  comprehensive  supervisory  and  audit  manager  reviews,  and 
(4)  DCAA  does  not  believe  that  the  approval  of  interim  vouchers  along 
with  the  approval  for  contractors  to  be  on  direct  billing  results  in  a  lack  of 
auditor  objectivity. 

We  continue  to  believe  that  DCAA’s  management  (nonaudit)  responsibility 
to  perform  prepayment  reviews  of  contractor  vouchers  for  DOD  and  the 
auditor’s  decision  making  role  of  approving  contractors  for  direct  billing 
privileges  based  on  its  audit  conclusions  about  the  strength  of  the 
contractor’s  system  of  internal  controls,  create  audit  objectivity  issues.  We 
revised  our  findings  discussion  and  our  recommendation  to  clarify  this 
point.  Under  normal  circumstances,  DCAA  must  review  contractor 
vouchers  prior  to  payment — a  management  support  function  for  DOD 
generally  performed  by  DCAA  field  office  administrative  staff.  By 
obtaining  direct  billing  privileges,  contractors  can  receive  payment  for 
goods  and  services  without  a  voucher  review  by  DCAA  prior  to  payment. 
Because  we  found  that  this  situation  provides  an  incentive  for  DCAA  to 
reduce  its  administrative  workload  by  recommending  that  contractors  are 
placed  on  direct  billing,  we  recommended  that  DCAA  develop  new  policies 
and  procedures  to  ensure  a  separation  between  staff  reviewing  vouchers 
and  staff  making  direct-bill  decisions.  In  addition,  DCAA  has  not  explained 
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the  basis  for  its  belief  that  administrative  staff  have  a  thorough 
understanding  of  the  contractors’  systems.  Further,  we  disagree  with 
DOD’s  statement  that  om  concerns  are  mitigated  based  on  the 
comprehensive  supervisory  and  audit  manager  reviews  because  this  is  not 
supported  by  our  findings.  The  fact  that  DCAA  approvals  of  contractor 
direct-bill  privileges  were  not  based  on  sufficient  audit  procedures  as 
demonstrated  by  our  work  and  DCAA’s  removal  of  over  200  contractors 
from  the  direct-bill  program  since  our  July  2008  report^®  support  our 
concern  that  the  existence  of  such  an  incentive  presents  an  objectivity 
impairment. 

DOD  provided  additional  comments  on  findings  in  its  transmittal  letter. 
DOD  stated  that  it  disagrees  with  the  suggestion  in  our  report  that  the 
department  has  not  yet  begun  to  address  the  weaknesses  we  identified. 
Our  report  neither  states  nor  implies  that  DOD  has  not  yet  begun  to  take 
action.  In  fact,  one  of  our  objectives  was  to  analyze  steps  DOD  has  taken 
so  far,  and  our  report  describes  in  detail  the  progress  made.  Our  report 
acknowledges  that  several  positive  steps  have  been  taken  by  DCAA,  but 
much  more  needs  to  be  done  to  address  the  fundamental  problems.  Thus, 
solutions  to  the  problems  documented  in  this  report  will  take  time  to  first 
implement  and  then  will  have  to  be  independently  assessed  to  make  sure 
they  are  effective.  Our  report  also  notes  that  fundamental  changes  have 
not  taken  place.  For  example,  to  date  DOD  has  not  revised  DCAA’s 
mission  statement  to  reflect  the  need  to  consider  the  public  interest  as  a 
key  component  of  its  work.  In  addition,  DCAA  has  yet  to  assess  the 
feasibility  of  3,600  auditors  issuing  over  20,000  reports  in  one  year  (22,349 
in  fiscal  year  2008)  and  the  appropriateness  and  need  for  the  current 
combination  of  audit  and  non-audit  services  that  drives  this  workload. 
Until  these  and  other  key  steps  are  further  along,  it  will  be  too  early  to 
assess  whether  DCAA  has  fundamentally  changed  or  whether  past 
practices  continue. 

The  DOD  comments  noted  that  one  of  our  major  findings  is  the  lack  of 
sufficient  testing  to  support  conclusions  when  giving  an  opinion  on 
contractor  internal  control  systems.  The  comments  incorrectly  refer  to  the 
requirement  for  sufficient  testing  as  a  GAO  requirement  and  state  that 
plarmed  staffing  increases  may  not  be  enough  to  accomplish  audits 
required  by  regulation  in  light  of  additional  testing  stipulated  by  GAO. 
Professional  audit  standards  have  always  required  auditors  to  obtain 
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sufficient  evidence  to  provide  a  reasonable  basis  for  the  conclusion 
expressed  in  the  report.  As  stated  in  our  report,  testing  methodologies  are 
a  matter  of  professional  judgment  and  can  involve  many  factors.  However, 
our  findings  reflect  more  than  a  difference  of  opinion  with  DCAA  auditors 
on  their  exercise  of  professional  judgment  as  reflected,  in  part,  by  the 
number  of  audit  reports  DCAA  rescinded  for  insufficient  testing.  For 
example,  we  found  insufficient  documentation  to  support  the 
methodology  chosen  and  insufficient  reasons  for  minimal  testing,  such  as 
being  told  by  a  DCAA  auditor  that  a  “file  size  was  too  large”  to  test  more 
than  two  recent  vouchers.  Again,  DOD  must  address  the  feasibility  of  3,600 
auditors  issuing  over  22,000  reports  annually,  most  of  which  were 
reportedly  performed  under  auditing  standards.  This  may  entail  not  only  a 
risk-based  audit  approach  but  also  exploring  changes  to  the  regulations 
that  DOD  represents  require  tens  of  thousands  of  these  audits. 

DOD  also  disagreed  with  our  position  on  the  status  of  actions  to 
strengthen  DCAA’s  quality  assurance  program.  DOD  stated  that  DCAA  has 
been  proactive  in  standing  up  its  new  Integrity  and  Quality  Assurance 
Directorate.  DOD  also  stated  that  it  believes  the  extensive  overhaul  of  the 
quality  assurance  function  accomplished  in  fiscal  year  2009  will  mitigate 
the  prior  shortcomings  in  audit  quality  that  we  cited.  Although  DOD’s 
comments  imply  that  DCAA  has  resolved  its  quality  assurance  problems, 
DCAA  has  acknowledged  that  it  is  not  ready  to  undergo  another  peer 
review  at  this  time.  On  September  1,  2009,  we  received  a  letter  from  the 
DCAA  Director,  stating  that  although  improvements  were  put  in  place  in 
fiscal  year  2009,  several  significant  improvements  will  be  accomplished  in 
fiscal  year  2010.  To  allow  sufficient  time  for  DCAA  to  fully  implement  the 
necessary  corrective  actions,  DCAA  contacted  us  for  guidance  on  (1) 
deferring  its  external  quality  control  review  for  2  years  and  (2)  requesting 
that  the  next  external  peer  review  to  cover  assignments  to  be  completed  in 
fiscal  year  2011.  We  agree  with  DCAA  that  it  is  not  cost-effective  to 
undergo  an  external  peer  review  until  an  adequate  system  of  quality 
control  is  in  place.  Expending  substantial  DOD  IG  resources  when  DCAA 
acknowledges  that  several  years  are  necessary  for  improvements  to  be 
fully  implemented  is,  in  our  view,  an  inefficient  use  of  resources.  DCAA 
has  already  begun  to  appropriately  disclose  in  its  reports  that  its  audits  do 
not  comply  with  GAGAS  external  peer  review  requirements. 

The  Director  of  Defense  Procurement  and  Acquisition  Policy  (DPAP) 
provided  additional  comments.  The  Director  stated  that  our  report 
impugns  DCAA’s  audits  and  that  we  adopt  the  position  that  because  DCAA 
is  serving  the  interests  of  contracting  officers,  DCAA  is  therefore  not 
auditing  in  the  interest  of  the  public.  The  Director  further  asserts  that 
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DCAA  serves  the  public  interest  by  providing  useful  and  timely 
information  to  contacting  officers,  and  that  it  is  erroneous  to  imply  that 
contracting  officers  do  not  seek  to  protect  the  public  interest.  Also,  the 
Director  states  that  GAO  agrees  with  the  Defense  Business  Board’s 
recommendation  to  revise  DCAA’s  mission  to  reflect  a  focus  on  the 
taxpayer  as  the  primary  customer.  Finally,  the  Director  suggests  that  our 
criticism  of  DCAA’s  “production-oriented  auditing”  sets  up  a  dichotomy 
between  quality  and  timely  audits.  We  disagree  with  these 
characterizations  of  our  report. 

DPAP’s  statements  that  our  report  impugns  DCAA’s  audits  and  that  we 
take  the  position  that  when  DCAA  is  serving  the  interests  of  contracting 
officers,  it  is  not  auditing  in  the  interest  of  the  public  relate  to  our 
summarization  of  the  Defense  Business  Board  (DBB)  report  and  not  our 
findings.  Our  report  does  not  endorse  the  specific  recommendations  of  the 
DBB  to  focus  on  the  taxpayer  as  the  primary  customer.  As  our  report 
points  out,  this  recommendation  does  not  take  into  account  the  regulatory 
and  policy  requirements  that  establish  DCAA’s  primary  role  as  an  advisor 
to  government  contracting  officers  and  disbursing  officers.  However,  we 
agree  with  the  DBB  that  DCAA  should  consider  the  public  interest  when 
carrying  out  GAGAS  engagements.  For  audits  and  attestation  engagements 
conducted  under  GAGAS,  the  auditor  is  expected  to  objectively  and 
independently  acquire  and  evaluate  sufficient,  appropriate  evidence,  and 
report  on  the  results,  consistent  with  the  guidance  in  GAGAS.  GAGAS 
states  the  principle  that  “observing  integrity,  objectivity,  and 
independence  in  discharging  [auditors’]  professional  responsibilities 
assists  auditors  in  meeting  the  principle  of  serving  the  public  interest  and 
honoring  the  public  trust. 

DPAP  also  stated  that  the  contracting  officer  is  bound  by  regulation  to 
meet  the  public  interest  in  the  broadest  sense,  for  the  entire  matter 
surrounding  a  contract  and  that  this  includes  factors  other  than  DCAA 
audit  findings  and  recommendations.  As  reflected  in  the  extensive 
background  discussion  and  elsewhere  throughout  our  report,  we 
recognize  that  contracting  officers  make  final  contracting  decisions,  and 
DCAA  engagements  support  contracting  officers  in  that  process.  Because 
we  did  not  review  the  standards  that  contracting  officers  must  follow,  we 
did  not  include  references  to  the  requirements  for  contracting  officers  to 


See  GAO-07-731G,  §  1.03. 
GAO-07-731G,  §  2.06. 
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protect  the  public  interest  in  their  actions.  Our  report  also  states  that 
DCAA  contract  audit  services  are  intended  to  be  a  key  control  to  help 
assure  that  prices  paid  by  the  government  for  needed  goods  and  services 
are  fair  and  reasonable  and  that  contractors  are  charging  the  government 
in  accordance  with  applicable  laws,  regulations  (e.g.,  Federal  Acquisition 
Regulation  (FAR)  and  Defense  Federal  Acquisition  Supplement  (DFARS), 
standards  (e.g.,  Cost  Accounting  Standards  (CAS)),  and  contract  terms.  In 
providing  this  assurance,  DCAA  audits  would  necessarily  take  into 
account  serving  the  public  interest.  However,  when  DCAA  audits  do  not 
meet  GAGAS,  they  do  not  provide  this  assurance  and  thus  are  not  serving 
the  public  interest.  We  found  that  DCAA  auditors  lacked  objectivity  and 
independence  when  performing  GAGAS  audits  and  engagements.  In  many 
cases,  this  was  a  result  of  auditors’  focus  on  expediency  to  support  client 
needs  and,  as  the  Director  also  observes,  human  capital  shortages  and 
poor  management  decisions.  We  do  not  question  the  need  for  contracting 
officers  to  use  the  services  of  advocates  and  assistants  in  carrying  out 
their  duties.  However,  when  contract  auditors  represent  that  they  are 
performing  engagements  under  GAGAS,  their  primary  focus  should  be  on 
the  integrity,  objectivity,  and  independence  of  their  work,  which  serves 
both  contracting  officers  and  the  public  interest.  Further,  the  quality  of 
DCAA  audits  impacts  the  quality  of  information  available  for  contracting 
officer  decisions.  Whether  DCAA  can  adhere  to  GAGAS  on  contract  audits 
that  provide  minimal  time  to  perform  the  work  is  a  factor  that  USD 
(AT&L)  should  consider  when  establishing  requirements  for  contract  audit 
services.  As  we  recommended,  DOD  should  reconsider  the  mix  of  audit 
and  non-audit  services  that  it  needs. 


DOD  IG  Comments  and  The  DOD  IG  concurred  with  our  recommendation  to  reconsider  its  overall 

Our  Response  conclusions  in  the  May  2007  report  on  the  audit  of  DCAA’s  quality  control 

system  in  which  it  reported  an  adequate  (“clean”)  opinion  on  DCAA’s 
system  of  quality  control  in  light  of  the  serious  deficiencies  and  findings 
included  in  that  report  and  the  additional  evidence  identified  in  our  audit. 
The  IG  also  stated  that  it  did  not  concur  with  our  recommendation  to 
rescind  the  report  and,  because  of  that  statement,  we  believe  the  IG 
misconstrued  our  recommendation  as  expressly  calling  for  a  rescission  or 
modification  of  its  peer  review  report.  Our  recommendation  was  for  the  IG 
to  determine,  based  on  the  results  of  our  recommended  reconsideration  of 
the  IG’s  conclusions,  whether  it  should  rescind  or  modify  the  peer  review 
report. 

The  DOD  IG  also  states  that  it  took  alternative  action  that  conformed  to 
the  intent  of  our  recommendation.  The  DOD  IG  comments  state  that  it 
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notified  DCAA  on  August  24,  2009,  that  the  May  2007  “adequate”  opinion 
on  DCAA’s  system  of  quality  control  would  expire  on  August  26,  2009.  In 
addition,  the  IG  stated,  “We  have  determined  that  it  is  not  prudent  to  allow 
the  adequate  opinion  from  our  May  2007  report  to  carry  forward.” 
However,  peer  review  opinions  neither  “expire”  nor  “carry  forward” 
beyond  the  period  covered  by  the  peer  review.  Peer  review  opinions  cover 
the  period  to  which  the  opinion  applied — in  DCAA’s  case,  as  of  the  end  of 
fiscal  year  2006 — and  the  peer  reviewed  audit  organization  need  not 
undergo  another  peer  review  during  the  next  2  years. Because  it  has 
been  more  than  3  years  since  DCAA’s  last  peer  review,  DCAA  is  no  longer 
in  compliance  with  the  GAGAS  requirement  for  an  external  peer  review, 
and  DCAA  has  taken  appropriate  action  to  disclose  this  noncompliance  in 
its  reports. 

As  stated  in  our  report,  the  overall  conclusion  in  the  DOD  IG  report  is 
inconsistent  with  the  detailed  observations  in  its  report,  which  indicate 
numerous  significant  deficiencies  in  DCAA’s  system  of  quahty  control. 
Further,  based  on  DCAA’s  actions  to  rescind  80  audit  reports,  39  of  which 
were  issued  in  fiscal  year  2006 — the  period  on  which  the  IG  conclusions 
are  based — and  the  findings  in  our  audit,  we  concluded  that  DCAA’s 
quality  control  system  for  the  period  covered  by  the  DOD  IG  peer  review 
was  not  effectively  designed  and  implemented  to  provide  assurance  that 
DCAA  and  its  personnel  comply  with  professional  standards. 


As  agreed  with  your  office,  unless  you  publicly  announce  the  contents  of 
this  report,  we  plan  no  further  distribution  for  30  days  from  the  report 
date.  At  that  time,  we  will  send  copies  of  this  report  to  the  Secretary  of 
Defense;  the  Under  Secretary  of  Defense  (Comptroller/CFO);  the  Under 
Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics;  the  DOD 
Director  for  Defense  Procurement  and  Acquisition  Policy;  the  Deputy 
General  Counsel  for  Acquisition;  the  Secretary  of  the  Army;  the  Secretary 
of  the  Navy;  the  Secretary  of  the  Air  Force;  the  Director  of  DCAA,  the 
Director  of  DCMA;  the  DOD  Inspector  General;  and  the  Director  of  the 
Office  of  Management  and  Budget.  In  addition,  this  report  will  be  available 
at  no  charge  on  the  GAO  Web  site  at  http://www.gao.gov.  Contact  points 
for  our  Offices  of  Congressional  Relations  and  Public  Affairs  may  be  found 
on  the  last  page  of  this  report. 


GAO-07-731G,  §  3.55. 
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If  you  or  your  staff  have  any  questions  concerning  this  report,  please 
contact  me  at  (202)  512-7922  or  kutzg@gao.gov  or  Gayle  Fischer,  Assistant 
Director,  Financial  Management  and  Assurance  at  (202)  512-9577  or 
fischerg@gao.gov. 


Gregory  D.  Kutz 
Managing  Director 

Forensic  Audits  and  Special  Investigations 
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In  performing  its  audits,  the  Defense  Contract  Audit  Agency  (DCAA)  states 
that  it  follows  generally  accepted  government  auditing  standards 
(GAGAS) '  As  part  of  our  assessment  of  DCAA’s  overall  management 
environment  and  quality  assurance  structure,  we  reviewed  documentation 
for  selected  DCAA  audits  of  contractor  systems  controls  for  compliance 
with  GAGAS.  We  focused  on  internal  control  audits  because  contracting 
officers  rely  on  DCAA  audit  opinions  on  contractor  system  controls  for  3 
or  more  years  to  make  decisions  on  pricing  and  contract  awards  and 
DCAA  uses  the  audit  opinions  to  assess  risk  when  planning  subsequent 
audits.  We  selected  seven  DCAA  field  audit  offices  (FAO)  across  the  five 
DCAA  regions  that  reported  predominately  adequate  (“clean”)  opinions  on 
contractor  controls.  For  the  seven  FAOs,  we  reviewed  37^  selected  audits 
of  contractor  internal  control  systems,  including  accounting,  estimating, 
billing,  and  indirect  and  other  direct  cost  systems.  As  shown  in  table  5,  we 
assessed  these  audits  for  compliance  with  eight  key  areas  of  GAGAS 
requirements:  (1)  auditor  independence;^  (2)  adequate  planning;  (3) 
auditor  understanding  of  controls;  (4)  design  of  procedures  to  detect  risk 
of  fraud,  abuse,  mismanagement,  and  contract  terms;  (5)  documentation 
of  sampling  and  testing;  (6)  audit  evidence  supports  conclusions  and 
opinion;  (7)  proper  supervision;  and  (8)  timely  reporting  and  disclosures.'* 
We  also  considered  GAGAS  requirements  for  protecting  the  public  interest 
when  using  auditor  judgment.**  As  discussed  in  the  body  of  this  report,  the 
37  audits  we  reviewed  did  not  comply  with  GAGAS  in  one  or  more  of  these 
areas.  However,  we  determined  that  4  of  the  37  audits  included  sufficient 
testing  to  support  reported  conclusions  and  opinions.  Because  the 
conclusions  and  opinions  in  the  deficient  audits  were  used  to  make  risk 
assessments  and  determine  the  level  of  testing  in  other  DCAA  audits,  such 
as  annual  audits  of  contract  or  incurred  cost  claims,  audits  of  contract 
proposals  and  contractor  forward  pricing  proposals,  progress  pay  audits, 
and  contract  close-out  audits,  the  audit  quality  issues  related  to  the 


*  CAM  2-lOlCa)  and  2-103cCl). 

^  We  originally  selected  39  internal  control  audits  for  our  review.  Because  two  audit 
assignments  were  performed  cis  assist  audits  to  an  internal  control  audit  in  our  selection, 
we  considered  these  three  assignments  as  one  audit,  and  therefore,  we  reviewed  a  total  of 
37  audits  of  contractor  system  internal  control  audits. 

^  GAO-03-673G,  Chapter  3,  especially  §§  3.03,  3.04,  and  3.13-3.17. 

^  GAGAS  for  attestations  audits  related  to  requirements  2  through  8  are  covered  in 
GAO-03-673G,  §§  6.04a;  6.13-6.14;  6.24a  &  c;  6.15a,  and  6.16-6.20;  6.02a,  6.04b,  6.22  and  6.24; 
and  6.28-6.64. 

**  GAO-03-673G,  §  3.33-3.38. 
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GAGAS  noncompliance  we  identified  potentially  impacts  hundreds  of 
other  audits  and  contracting  decisions  covering  billions  of  dollars  in  DOD 
expenditures. 


Table  5:  GAGAS  Noncompliance  on  37  Selected  Audits  of  Contractor  Controls 


DCAA  regions 


Reasons  for  GAGAS  noncompliance 

Northeast 
(FAO  #1) 

Mid-Atlantic 
(FAO  #2) 

Eastern 
(FAO  #3) 

Central 
(FAO  #4  &  5) 

Western 
(FAOs  #6  &  7) 

All 

regions 

Independence  impairments 

0 

0 

1 

2 

4 

7 

Inadequate  planning 

0 

4 

1 

5 

7 

17 

Inadequate  auditor  understanding  of  controls 

1 

4 

0 

2 

5 

12 

Lack  of  fraud  risk  detection  procedures 

4 

5 

6 

11 

9 

35 

Insufficient  documentation  on  sampling 
methodology 

3 

5 

6 

9 

4 

27 

Insufficient  evidence  to  support  conclusions  and 
opinion 

3 

5 

6 

11 

8 

33 

Improper  Supervision 

0 

0 

2 

5 

6 

13 

Reporting  problems 

4 

5 

6 

12 

10 

37 

Total  GAGAS  noncompliance  issues 

15 

28 

28 

57 

53 

181 

Number  of  audits 

4 

5 

6 

12 

10 

37 

Rescinded  reports 

1 

3 

3 

7 

4 

18 

Source: 

GAO  analysis  of  selected  DCAA  audits. 

Note:  Because  ofthe  large  size  of  the  Central  and  Western  regions,  we  tested  audits  atmore  than 
one  field  audit  office  in  these  regions. 

The  following  discussion  includes  examples  of  GAGAS  noncompliance 
from  specific  audits  we  reviewed. 


Independence 

Impairments 


GAGAS  state  that  the  audit  organization  and  the  individual  auditor  should 
be  free,  both  in  fact  and  appearance,  from  personal,  external,  and 
organizational  impairments  to  independence.*^  Our  review  of  37  audits  of 
contractor  internal  controls  found  evidence  in  documentation  for  7  audits 
that  DCAA  independence  was  compromised  because  auditors  provided 
material  nonaudit  services  to  a  contractor  they  later  audited;  experienced 
access-to-records  problems  that  were  not  resolved;  delayed  report 
issuance,  which  allowed  the  contractor  to  resolve  cited  deficiencies. 


**  GAO-03-673G,  §  3.03,  and  GAO-07-731G,  §  3.02. 
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without  proper  reporting;  and  performed  test  work  on  billings  the 
contractor  selected  for  testing.  GAGAS  state  that  auditors  should  be  free 
from  influences  that  restrict  access  to  records  or  improperly  modify  audit 
scope. ^  GAGAS  also  state  that  audit  organizations  should  not  audit  their 
own  work  or  provide  nonaudit  services  if  the  services  are  significant  or 
material  to  the  subject  matter  of  the  audit.®  The  following  examples 
describe  a  situation  where  auditors  assisted  a  Department  of  Defense 
(DOD)  contractor  in  developing  billing  system  policies  and  procedures 
after  identifying  five  significant  deficiencies  and  then  reviewed  their  own 
work  during  a  follow-up  audit. 


DCAA  Auditors  Issued  an  Adequate  Opinion  on  Controls  They  Helped  Design 

DCAA  auditors  impaired  their  independence  by  performing  nonaudit  services  for  one  of 
the  top  five  DOD  contractors  in  terms  of  doiiars  when  they  heiped  the  contractor  deveiop 
poiicies  and  procedures  that  were  materiai  to  the  biiiing  system  they  were  auditing. 

On  May  12,  2005,  DCAA  reported  an  inadequate-in-part  opinion  on  the  contractor's 
biiiing  system  internai  controis.  The  report  inciuded  five  significant  deficiencies,  inciuding 
a  faiiure  to  maintain  current,  adequate  biiiing  system  poiicies  and  procedures.  After 
issuing  the  report,  DCAA  auditors  heiped  the  contractor  deveiop  adequate  poiicies  and 
procedures  reiated  to  accounts  receivabie,  overpayments,  and  monitoring  of  the  biiiing 
system  before  performing  the  required  foiiow-up  audit— an  impairment  to  auditor 
independence.  A  year  iater,  after  performing  the  foiiow-up  audit,  DCAA  auditors 
conciuded  that  the  contractor  had  performed  adequate  actions  to  correct  aii  of  the  biiiing 
system  deficiencies  previousiy  reported.  On  J  une  28,  2006,  DCAA  reported  an  adequate 
opinion  on  the  contractor's  biiiing  system  internai  controis. 

Foiiowing  GAO's  review  of  these  audits,  on  March  6,  2009,  DCAA  rescinded  the  biiiing 
system  audit  foiiow-up  report. 


We  also  noted  instances  of  denials  and  limitations  on  access  to  records  by 
contractors  that  were  not  handled  properly.  For  example,  during  a  billing 
system  audit  of  one  of  the  top  five  DOD  contractors,  an  e-mail  message 
documented  in  the  audit  workpapers  showed  that  the  auditors  were 
challenged  by  a  contractor  official  when  they  requested  documentation  to 
test  whether  billing  clerks  had  received  required  training.  The  contractor’s 
e-mail  stated,  “Here’s  a  question  for  you.  Can  you  tell  me  who  and  what 
requirement  is  making  this  part  of  the  [audit].  This  is  a  question  that  [is] 
being  asked  by  [the  Cash  Manager].’’  The  auditors  eventually  obtained 
limited  training  documentation  from  the  contractor.  Audit  documentation 
and  our  interviews  with  the  auditors  revealed  that  the  auditors  also  limited 


See  GAO-03-673G,  §  3.19  and  GAO-07-731G,  §  3.10. 
®  GAO-03-673G,  §  3.16. 
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testing  in  several  other  areas  “because  the  contractor  would  not 
appreciate  it.”  Access  to  records  problems  and  strong  external  influence  to 
limit  testing  are  both  impairments  to  independence  according  to  GAGAS.'* * 


Inadequate  Planning  GAGAS  for  attestation  engagements  state  that  the  work  shall  be 

adequately  plarmed.  “  Auditors  should  communicate  information  regarding 
the  nature,  timing,  and  extent  of  planned  testing  and  reporting  to  officials 
of  the  audited  entity  and  to  the  individuals  contracting  for  or  requesting 
the  attestation  engagement.  Auditors  should  also  plan  work  to  follow  up 
on  actions  to  address  significant  findings  and  recommendations  in 
previous  audits  and  assess  areas  of  risk  in  planning  the  engagement. 
However,  our  review  of  the  audit  documentation  determined  that  17  of  the 
37  internal  control  audits  we  reviewed  were  not  adequately  planned. 

•  In  five  audits,  auditors  failed  to  consider  risk  associated  with  new 
systems  that  had  not  yet  been  audited  or  systems  that  had  not  been 
audited  in  more  than  4  years.  These  audits  should  have  been  ascribed  a 
higher  risk  level  according  to  DCAA  CAM  guidance  and  testing  should 
have  been  increased.  “  DCAA  has  rescinded  three  of  the  five  audits  and 
is  planning  new  audits,  as  appropriate. 

•  Without  documenting  the  basis  for  their  decisions,  auditors  deleted 
audit  steps  from  standard  audit  programs  or  did  not  perform  all  audit 
steps  for  three  of  seven  audits  we  reviewed  at  one  FAO.  When  we 
asked  the  auditors  why  they  omitted  key  audit  procedures  in  their 
work,  the  auditors  told  us  they  used  “auditor  judgment.”  However,  the 
auditors  would  not  explain  the  basis  for  their  judgments  to  us  or  their 
rationale  for  omitting  key  procedures,  such  as  assessing  the 
contractor’s  control  environment  and  testing  the  implementation  of  a 
contractor’s  policies  and  procedures.  Because  we  did  not  find  any 
justification  for  omitting  key  audit  procedures  in  these  three  audits,  we 
determined  that  they  were  inadequately  planned. 

The  following  case  discussion  illustrates  deficiencies  in  audit  planning  as 
well  as  a  lack  of  auditor  understanding  of  contractor  processes  and 
controls. 


^  See  GAO-03-673G,  §  3.19,  and  GAO-07-731G,  §  3.10. 
“  GAO-03-673G,  §§  6.04a,  6.06,  and  6.11. 

“  CAM  5-103. 
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DCAA  Erroneously  Performed  an  Audit  over  a  Billing  System  That  Did  Not  Exist 

In  2004,  a  Western  Region  FAO  planned  a  billing  system  audit  of  a  federally  funded 
research  and  development  center  (grantee)  that  receives  $1.5  billion  annually  for 
research  services.  However,  the  planning  for  this  billing  system  audit  did  not  take  into 
account  the  fact  that  grantees  are  funded  through  letters  of  credit  and  do  not  actually 
bill  the  government.  This  financial  relationship  is  very  different— and  much  less 
complicated— than  a  situation  where  a  contractor  bills  the  government  for  contract  costs 
in  accordance  with  Cost  Accounting  Standards  and  the  Federal  Acquisition  Regulation. 
For  example,  undera  letter  of  credit  financing  arrangement,  grantees  draw  funds  as 
disbursements  are  made  and  are  required  to  prepare  reports  of  transactions  on  their 
use  of  the  funds  and  submit  them  to  the  funding  agency.  Despite  this  obvious  mistake, 
on  May  6,  2005,  DCAA  auditors  issued  a  report  stating  that  the  grantee  had  an 
"adequate  billing  system." 

Another  report  issued  by  the  same  DCAA  office  on  J  une  25,  2004,  reviewed  the 
grantee's  cash  management  practices  under  the  Single  Audit  Act  for  another  federal 
agency.  The  auditors  could  have  simply  forwarded  this  report  to  the  DOD  contracting 
officer— a  task  that  would  take  an  hour  at  the  most  to  complete.  Instead,  DCAA  auditors 
charged  over  530  staff  hours  to  generate  documentation  to  meet  DCAA's  billing  system 
audit  requirements,  even  though  there  was  no  related  "billing  system."  As  a  result  of  our 
review,  DCAA  reassessed  the  need  to  perform  a  billing  system  audit  for  the  grantee 
and  determined  that  it  would  rely  on  the  Single  Audit  Act  reports  in  the  future.  DCAA 
has  not  rescinded  the  audit  report  even  though  it  expresses  an  opinion  on  a  nonexistent 
system. 


Auditors  Did  Not  Properly 
Document  Understanding 
of  Controls  for  Several 
Audits 


GAGAS  require  that  in  planning  examination-level  attestation 
engagements,  auditors  should  obtain  a  sufficient  understanding  of  internal 
control  that  is  material  to  the  subject  matter  and  design  procedures  to 
achieve  the  objectives  of  the  audit.  The  subject  matter  or  assertion  the 
auditor  is  testing  may  relate  to  the  effectiveness  and  efficiency  of 
operations,  including  the  use  of  an  entity’s  resources;  the  reliability  of 
financial  reporting,  including  reports  on  budget  execution  and  other 
reports  for  internal  and  external  use;  compliance  with  apphcable  laws  and 
regulations,  provisions  of  contract,  or  grant  agreements;  and  safeguarding 
of  assets.  “  Although  most  of  the  37  internal  control  audits  we  reviewed 
met  this  standard,  12  audits  did  not.  The  following  case  study  shows  an 
example  of  insufficient  understanding  of  controls. 


•  On  five  audits,  auditors  overstated  the  strength  of  the  contractor’s 
control  environment  in  the  audit  documentation  and  used  this 
information  to  justify  performing  httle  or  no  testing  of  controls  for 


GAO-03-673G,  §§6.13-6.14. 

“  GAO-03-673G,  §§6.13  and  6.14. 
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accounting  and  billing  system  control  audits.  On  two  of  the  five  audits, 
a  Mid-Atlantic  Region  auditor  admitted  that  he  included  inaccurate 
statements  in  the  audit  documentation.  These  statements  indicated 
that  the  contractor  performed  internal  audits  and  had  a  formal 
management-level  monitoring  process  over  accoimting  and  billing 
functions.  When  we  requested  copies  of  the  internal  audits  and 
management  reviews,  the  auditor  admitted  that  these  statements  were 
not  true  and  that  he  had  made  “mistakes.”  He  entered  the  factually 
incorrect  information  in  the  audit  documentation  to  justify  performing 
little  or  no  testing.  The  auditor  was  a  GS-13  technical  specialist  who 
reviewed  the  work  of  other  auditors  and  provided  them  audit  guidance. 
DCAA  has  rescinded  four  of  the  five  audits  and  is  planning  or  initiating 
new  audits. 

•  On  another  audit  involving  a  business  segment  of  a  third  contractor  of 
the  top  5  DOD  contractors,  auditors  did  not  consider  the  contractor’s 
control  environment  in  planning  an  audit  of  a  new  accounting 
system — a  significant  factor  that  resulted  in  insufficient  testing. 
Further,  after  identifying  significant  accounting  system  deficiencies, 
including  that  certain  contract  costs  are  manually  processed,  are  not 
processed  timely,  or  are  not  adequately  reconciled  to  actual  incurred 
costs,  the  auditors  delayed  issuance  of  the  audit  report  for  about  16 
months,  waiting  to  see  if  the  contractor  would  take  corrective  actions 
on  the  identified  deficiencies.  Although  test  procedures  were  applied 
from  February  25,  2004,  to  September  15,  2004,  DCAA  reported  an 
“inadequate-in-part”  opinion  on  the  contractor’s  accounting  system  on 
March  14,  2006 — ^nearly  1-1/2  years  later,  without  performing  any 
additional  testing.  Following  discussions  with  GAO,  DCAA  rescinded 
this  audit  report  on  November  20,  2008. 

In  the  audit  described  below,  the  auditor  relied  on  the  contractor  to 

document  the  auditor’s  understanding  of  controls. 
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DCAA  Auditors  Relied  on  the  Contractor  to  Document  Internal  Controls  without 
Testing  the  Accuracy  of  the  Documentation 

This  case  involves  a  billing  system  audit  DCAA  conducted  in  2006.  The  last  time  DCAA 
had  tested  the  billing  system  for  this  contractor  was  in  2000— a  clear  indication  that  new 
tests  should  be  performed.  At  that  time,  DCAA's  CAM  required  that  contractor  internal 
control  systems  be  audited  every  2  to  4  years.  However,  rather  than  re-testing  the 
billing  system,  DCAA  auditors  provided  the  contractor's  Information  Systems  Manager 
with  6-year-old  documentation  obtained  during  a  DCAA  auditor's  walkthrough  of  the 
billing  process  in  the  prior  audit.  The  DCAA  auditors  asked  the  Information  Systems 
Manager  to  update  the  documentation  by  making  edits  where  necessary.  According  to 
the  audit  workpapers,  the  6-year-old  documentation  was  "edited  by  the  contractor"  and 
provided  back  to  the  DCAA  auditor.  Based  on  the  contractor's  documentation  of  the 
billing  system  internal  controls,  the  auditor  concluded  "we  can  limit  our  testing  of 
management  reviews,  policies  and  procedures,  and  implementation  of  policies  and 
procedures. "The  auditor  then  traced  one  paid  voucher  through  the  billing  process.  This 
procedure  relates  to  determining  whether  the  auditor's  understanding  of  the  process  is 
correct  and  is  not  substantive  testing  (i.e.,  detailed  tests  of  transactions  and  balances 
and  analytical  review  procedures.) 

The  auditor  told  GAO  that  she  used  this  "low-risk  approach"  because  she  felt  that  the 
contractor's  system  was  "strong"  and  did  not  warrant  a  higher  risk  approach.  However, 
according  to  the  documentation  GAO  reviewed,  the  billing  system  was  a  software 
package  that  downloads  accounting  system  data  to  spreadsheets.  Manual  calculations 
were  then  used  to  develop  invoice  amounts— a  process  that  is  prone  to  errors  and  does 
not  provide  assurance  of  consistent  systematic  processing  of  invoices.  Further,  since 
DCAA's  earlier  walkthrough  in  2000,  the  contractor  had  experienced  significant 
downsizing  and  restructuring. 

The  auditor  performed  no  testing  of  the  contractor's  billing  system  controls  in  order  to 
determine  whether  the  system  was  operating  effectively  at  the  time  of  the  audit.  The 
audit  report  that  was  issued  onj  une  21,  2006,  with  an  adequate  opinion  was  not  based 
on  sufficient  audit  procedures  to  provide  assurance  over  approximately  $76  million  in 
sales  to  the  government.  After  GAO  raised  concerns  about  this  audit,  DCAA  rescinded 
the  audit  report  on  March  3,  2009. 


Failure  to  Design  and  For  DCAA  examination-level  attestation  audits  of  contractor  controls  that 

Perform  Procedures  to  reviewed,  gagas  requires  auditors  to  design  and  perform  audit  steps 

Detect  Fraud  Risk  obtain  reasonable  assurance  of  detecting  fraud,  illegal  acts,  or 

violations  of  provisions  of  contracts  that  could  have  a  material  effect  on 
the  subject  matter  of  the  engagement  or  internal  control.  DCAA 
management  asserts  that  its  examination-level  audits  are  designed  to 
provide  this  assurance,  and  DCAA  internal  guidance  requires  auditors  to 
consider  a  list  of  fraud  indicators  included  in  DCAA’s  CAM“  or  the  DOD 


GAO-03-673G,  §6. 16a. 
CAM,  Figure  4-7-3. 
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Inspector  General’s  Handbook  on  Fraud  Indicators  “  in  planning  and 
performing  their  work.  However,  for  35  of  the  37  internal  control  audits 
we  reviewed  there  was  no  evidence  that  DCAA  auditors  designed  specific 
procedures  to  identify  risk  of  fraud,  illegal  acts,  violations  of  contract 
terms,  or  other  improprieties.  Further,  our  analysis  of  audit  workpapers 
showed  that  DCAA  auditors  lacked  an  understanding  of  fraud  indicators 
associated  with  weak  internal  controls.  For  example,  although  segregation 
of  duties  is  a  key  fraud-prevention  control,  in  the  seven  audits  where 
workpapers  identified  segregation  of  duties  issues,  the  auditors  did  not 
consider  a  lack  of  segregation  of  duties  to  be  a  fraud  risk  in  6  of  the  audits. 
The  auditors  did  not  look  for  a  compensating  control  or  perform 
additional  procedures  to  determine  whether  the  lack  of  segregation  of 
duties  had  allowed  fraud  to  occur.  Occurrences  of  duplicate  invoices  also 
would  increase  the  risk  of  fraud.  However,  DCAA’s  audit  program  for 
testing  contractor  billing  system  controls  does  not  include  specific 
procedures  to  test  for  duplicate  contractor  invoices.  We  found  evidence  of 
testing  related  to  duplicate  invoices  in  only  2  of  the  37  internal  control 
audits  we  reviewed.  Moreover,  in  the  audit  described  below,  DCAA  FAO 
managers  ordered  an  auditor  to  ignore  significant  fraud  risks  during  an 
audit. 


DCAA  FAO  and  Region  Management  Prevented  an  Auditor  from  Pursuing 
Significant  Fraud  Risks  during  a  Billing  System  Audit 

During  a  fiscal  year  2003  incurred  cost  audit  of  a  major  defense  contractor,  a  DCAA 
Central  Region  auditor  learned  of  a  fraud  investigation  initiated  by  the  Army's  Criminal 
Investigative  Division  (CID)  in  response  to  allegations  of  contractor  fraud  reported  in 
August  2002.  In  J  uly  2004,  during  a  billing  system  audit  of  the  same  contractor,  the 
auditor  contacted  the  Army  CID  investigator  to  discuss  the  ongoing  fraud  investigation 
and  learned  that  the  fraud  related  to  improper  billings.  As  a  result  of  this  elevated  fraud 
risk,  the  auditor  requested  several  nominal  increases  in  budget  hours  to  perform 
additional  testing  to  determine  the  extent  of  the  fraud.  The  auditor  had  prior  DOD 
contract  administration  experience  and  intended  to  use  this  experience  in  applying  her 
audit  testing  procedures.  After  approving  increases  in  budgeted  hours  for  this 
assignment,  the  regional  audit  manager  told  the  auditor  that  her  concerns  v\/ere  not 
valid  and  to  remove  her  "contracting  hat." 

E  ight  months  later,  on  April  28,  2005,  the  auditor  submitted  a  draft  audit  report  to  her 
supervisor.  She  concluded  thatthe  contractor's  billing  system  was  inadequate— a 
finding  that  would  have  resulted  in  the  contractor  losing  its  direct-billing  privileges.  The 
auditor  noted  several  deficiencies  and  concerns,  including  (1)  the  lack  of  billing  policies 
and  procedures,  (2)  a  lack  of  training  for  contractor  employees  responsible  for 
preparing  invoices,  (3)  indications  thatthe  contractor  may  have  billed  the  government 
for  unapproved  and  unfunded  work,  and  (4)  evidence  of  an  ongoing  criminal _ 


DOD  Inspector  General,  Handbook  on  Fraud  Indicators  for  Contract  Auditors,  Section 
II.4  (IGDH  7600.3  APO,  March  31,  1993). 
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investigation  by  the  Army  CiD.  After  reviewing  the  report,  the  supervisor  and  FAO 
manager  directed  the  auditor  to  change  the  opinion  from  inadequate  to  inadequate-in¬ 
part  because  the  auditor  had  not  identified  any  excess  or  unaiiowabie  costs.  The  audit 
report,  issued  on  August  31,  2005,  reported  an  inadequate-in-part  opinion  and 
combined  the  first  two  deficiencies,  reporting  a  totai  of  three  significant  deficiencies. 
However,  DCAA  did  not  remove  the  contractor  from  the  direct-biii  program,  whereby 
contractors  are  authorized  to  submit  invoices  directiy  to  a  government  paying  office 
without  prior  review. 

The  auditor  assigned  to  the  originai  audit  was  aiso  assigned  to  the  biiiing  system  foiiow- 
up  audit,  but  she  was  subsequentiy  removed  from  the  foiiow-up  audit  because, 
according  to  her  supervisor,  she  was  documenting  her  audit  in  too  much  detaii.  in 
J  anuary  2006,  during  the  foiiow-up  audit.  Army  CiD  conciuded  its  fraud  investigation. 
The  contracting  officer's  technicai  representative  (COTR)  and  severai  contractor 
empioyees  were  convicted  of  fraud uientiy  biiiing  the  government  using  the  biiiing 
system  that  DCAA  iater  deemed  adequate.  The  investigation  found  that  the  COTR  and 
the  contractor  empioyees  were  charging  the  government  for  travei  to  contract-reiated 
conferences  and  arranging  the  trips  so  they  couid  attend  a  NASCAR  race  at 
government  expense.  They  took  government  cars  on  the  trips  and  various  contractor 
empioyees  each  charged  the  government  for  use  of  their  personai  cars,  with  the  COTR 
approving  the  travei  vouchers,  in  addition,  the  COTR  had  contractor  empioyees  cut 
scrap  iumber  on  government  iand  and  stack  it  at  his  home  for  use  as  firewood.  The 
government  was  biiied  forthe  contractor  empioyees' time  on  behaifofthe  COTR.  In  the 
J  anuary  2006  settlement,  which  totaled  over  $2.8  million,  the  COTR  and  contractor 
employees  paid  fines  and  restitution,  and  the  COTR  also  served  jail  time. 

The  Army  CID  Special  Agent  in  charge  of  the  fraud  investigation  told  us  that  he  had 
tried  on  numerous  occasions  to  get  the  DCAA  FAO  manager  to  stop  issuing  incurred 
cost  audit  reports  with  "clean"  opinions  because  the  opinions  would  be  contradicted  by 
the  findings  in  the  ongoing  fraud  investigation.  The  FAO  issued  the  2002  incurred  cost 
audit  report  on  J  anuary  5,  2005,  stating  its  opinion  that  except  for  the  qualification  that 
the  ongoing  fraud  investigation  had  developed  information  which  may  impact  the  costs 
and  transactions  in  this  report,  the  claimed  direct  costs  are  acceptable  and  are 
provisionally  approved,  pending  final  acceptance.  DCAA  did  not  include  a  cautionary 
note  or  similar  qualification  in  the  billing  system  audit  report.  In  September  2006,  DCAA 
reported  an  adequate  ("clean")  opinion  in  the  follow-up  audit  report  on  the  contractor's 
billing  system  controls  without  performing  work  to  confirm  that  the  contractor's  billing 
system  policies  and  procedures  were  effectively  implemented. 

Following  GAO's  review  of  these  audits,  on  November  20,  2008,  DCAA  rescinded  both 
reports  because  the  audit  documentation  did  notsupportthe  reported  opinions  and 
initiated  a  new  audit  of  the  contractor's  billing  system  controls. 


Insufficient 
Documentation  of 
Sampling  and  Testing 
Methodology 


Testing  is  a  critical  auditing  procedure  that  allows  auditors  to  determine 
whether  controls  are  operating  effectively.  Although  some  testing  can 
involve  statistical  samples,  such  samples  are  not  required  under  GAGAS. 
Instead,  GAGAS  require  that  auditors  prepare  attest  documentation  in 
sufficient  detail  to  enable  an  experienced  auditor,  having  no  previous 
cormection  to  the  audit,  to  ascertain  from  the  attest  documentation  that 
the  evidence  supports  the  auditors’  significant  judgments  and  conclusions. 
Under  GAGAS,  attest  documentation  should  contain  the  objectives,  scope, 
and  methodology  of  the  attestation  engagement,  including  any  sampling 
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and  other  selection  criteria  used.'^  Of  the  37  internal  control  audits  we 
reviewed,  27  audits  did  not  contain  workpaper  documentation  to 
demonstrate  that  the  auditors’  nonstatistical  samples  met  these 
requirements,  for  example: 

•  On  one  bilhng  system  audit,  the  auditor  performed  testing  on  two 
vouchers.  The  auditor  did  not  document  how  he  selected  the  two 
vouchers,  and  he  did  not  document  the  population  of  contractor 
vouchers  in  the  workpapers  or  the  basis  for  his  judgment  on  selecting 
the  two  vouchers  for  testing.  When  we  asked  the  auditor  why  he 
selected  two  most  recent  vouchers  for  testing  and  did  not  document 
the  voucher  population,  the  auditor  told  us  it  was  because  “the  file  size 
was  too  large,”  and  he  saves  the  population  files  on  his  desktop 
computer. 

•  On  a  billing  system  audit  of  one  of  the  five  largest  DOD  contractors  we 
asked  the  auditor  why  he  tested  only  one  voucher  to  assess  the 
contractor’s  controls  for  subcontractor  accounting  and  billing.  The 
auditor  said  this  was  reasonable  because  DCAA  “had  tested  so  many 
vouchers  before.”  Other  workpaper  documentation  noted  testing  was 
not  performed  on  the  direct-bill  section  of  the  audit  program.  When  we 
asked  the  auditor  why  these  procedures  were  not  performed,  the 
auditor  told  us  that  testing  was  performed  by  another  FAO  when  the 
contractor  implemented  a  new  system  2  months  earlier,  and  he  decided 
not  to  do  testing  again  because  “the  contractor  would  not  appreciate 
it” — an  indication  of  an  auditor  independence  problem.  Moreover,  tests 
of  new  billing  systems  focus  on  data  processing  controls  and  would  not 
take  the  place  of  tests  of  invoices  for  compliance  with  CAS,  FAR,  and 
contract  terms. 

Although  the  CAM  includes  guidance  on  sufficient  testing,'®  auditors 
appeared  to  follow  general  guidance  throughout  the  manual  that  advises 
auditors  to  use  their  judgment  “to  ‘test  check’  a  procedure,  to  make 
verifications  ‘on  a  selective  basis,’  or  to  review  a  ‘representative  number’ 
of  transactions  or  items.”  Several  auditors,  field  office  managers,  and 
DCAA  headquarters  officials  told  us  that  they  believed  “spot  checks”  were 
sufficient  testing  to  conclude  on  controls  overall  and  they  did  not  believe 
they  were  required  to  document  their  sampling  plans. 


GAO-03-673G,  §§  6.04b,  6.22,  and  6.24a. 
CAM  4-600  and  Appendix  B. 
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DCAA  Relied  on  Faulty  Auditor  Judgment  to  Approve  Contractor  Controls 

An  Eastern  Region  auditor  performed  minimai  testing  in  an  audit  of  controis  over 
indirect  and  other  direct  cost  for  a  business  segment  of  one  of  the  top  five  DOD 
contractors  that  biiied  the  government  for  about  $1  biiiion  during  2006.  The  auditor  did 
not  use  statisticai  sampiing  or  test  a  representative  seiection  of  accounts  payabie 
transactions,  instead,  without  documenting  the  reasons  for  his  judgments,  the  auditor 
tested  6  of  16,000  accounts  payabie  transactions  ($86  of  $50  miiiion),  3  of  4,500  travei 
transactions  ($2,700  of  $15  miiiion),  and  3  of  1,600  interdivisionai  transactions  ($5,000 
of  $16  miiiion).  On  September  27,  2006,  DCAA  reported  an  adequate  opinion  on  the 
contractor's  controis  over  direct  and  indirect  costs.  However  our  review  of  the  audit 
workpapers  reveaied 

•  no  expianation  of  why  so  few  transactions  were  tested, 

•  no  rationaie  for  why  transactions  seiected  for  testing  covered  the  months  of  May 
through  J  uiy  2005,  when  transactions  occurred  throughout  the  year,  or 

•  how  the  auditor  conciuded  that  the  system  was  adequate  based  on  testing  12  out 
of  about  22,000  transactions. 

When  we  asked  the  auditors  to  expiain  the  basis  for  their  seiection  of  transactions  used 
for  testing,  FAO  management  said  the  seiection  was  based  on  auditor  judgment; 
impiying  auditors  couid  use  their  professionai  judgment  without  the  need  to  meet  any 
specific  criteria  in  doing  so.  GAGAS  section  3.34  (GAO-03-673G)  states  that  auditors 
shouid  consider  the  need  to  protect  the  pubiic  interest  when  making  professionai 
judgments.  GAGAS  section  6.02a  requires  auditors  to  perform  sufficient  testing  to 
support  audit  conciusions  and  opinions  on  controis.  Determining  what  is  sufficient 
testing  requires  auditors  to  determine  an  appropriate  sampie  size  considering  risks, 
expectation  of  misstatements  or  deviations,  and  materiaiity,  and  seiecta  representative 
sampie  from  the  popuiation,  meaning  that  aii  transactions  have  a  known  chance  of 
being  seiected.  GAGAS  section  6.24  a.  and  c.  require  auditors  to  document  the 
sampiing  pian  and  auditor  judgments  made  in  sampiing  and  testing.  This  audit  did  not 
meet  these  GAGAS  requirements. 


Insufficient  Evidence  to 
Support  Audit  Conclusions 
and  Opinions 


We  found  that  audit  procedures  for  most  of  the  37  internal  control  audits 
we  reviewed  documented  the  design  of  controls  but  did  not  test  the 
implementation  of  controls.  As  a  result,  the  audits  lacked  sufficient 
evidence  to  support  audit  opinions  that  covered  both  the  design  and 
implementation  of  controls.  GAGAS  for  examination-level  attestation 
engagements  require  that  sufficient  evidence  be  obtained  to  provide  a 
reasonable  basis  for  the  conclusion  that  is  expressed  in  the  report.  “ 
GAGAS  state  that  attest  documentation  serves  to  (1)  provide  the  principal 
support  for  the  auditor’s  report,  (2)  aid  auditors  in  conducting  and 
supervising  the  attestation  engagement,  and  (3)  allow  for  the  review  of  the 
quality  of  the  attestation  engagement.  The  preparation  of  attest 
documentation  should  be  appropriately  detailed  to  provide  a  clear 


“  GAO-03-673G,  §6.04b. 
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understanding  of  its  purpose  and  source  and  the  conclusions  the  auditors 
reached,  and  it  should  be  appropriately  organized  to  provide  a  clear  link  to 
the  findings,  conclusions,  and  recommendations  contained  in  the  auditors’ 
report.^” 

Overall,  we  found  that  33  of  the  37  internal  control  audits  did  not  include 
sufficient  testing  of  internal  controls  to  support  auditor  conclusions  and 
opinions.  Our  review  of  audit  workpapers  often  found  that  only  two,  three, 
or  sometimes  five  transactions  were  tested  to  support  audit  conclusions, 
for  example: 

•  On  several  audits,  DCAA  concluded  that  a  contractor  had  adequate 
controls  for  removing  system  access  for  terminated  or  transferred 
employees.  However,  the  auditors  did  not  document  the  employee 
population  from  which  individual  employees  were  selected  for  testing 
system  access,  or  the  methodology  used  to  select  them.  On  none  of 
these  audits  did  we  see  evidence  that  DCAA  auditors  checked 
alphabetical  listings  of  individuals  having  system  access  to  lists  of 
current  personnel  to  confirm  that  access  was  removed  when 
employees  transferred  or  left  the  company.  Without  documentation  of 
sampling  and  testing  methodologies,  there  is  no  way  to  ascertain  how 
the  auditors  came  to  their  conclusions  that  controls  were  adequate  or 
that  sufficient  testing  was  done  to  support  audit  conclusions. 

•  For  many  controls,  DCAA  did  not  perform  any  testing  at  all.  For 
example,  at  least  6  of  the  9  accounting  audits  we  reviewed  did  not 
include  procedures  for  testing  contractor  segregation  of  allowable  and 
unallowable  cost;  20  of  22  billing  system  audits  we  reviewed  did  not 
include  tests  to  identify  duplicate  invoices,  and  10  of  the  22  billing 
system  audits  of  contractors  that  relied  on  manual  procedures  to 
prepare  invoices  from  accounting  system  data  queries  did  not  check 
for  compensating  controls.  For  one  audit,  DCAA  issued  an  adequate 
opinion  on  the  accounting  system  for  a  major  DOD  contractor  after 
performing  a  walkthrough  of  the  accounting  process  and  interviewing 
two  employees. 


GAO-03-673G,  §6.24. 
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Adequate  Opinion  on  Contractor  Billing  System  Was  Based  on  Spot  Checks  of  4 
Vouchers  Generated  on  the  Same  Day 

A  Mid-Atlantic  Region  auditor  used  interviews  with  contractor  staff  and  limited  testing  as 
evidence  that  billing  system  controls  were  adequate  for  a  DOD  contractor  with  about 
$40  million  in  annual  government  sales.  Workpapers  documenting  audit  procedures  on 
key  internal  controls  referred  to  "discussions  with  the  contractor"  rather  than 
independent  auditor  verification,  including  (1)  verification  of  periodic  reviews  of 
contractor  policies  and  procedures,  (2)  implementation  and  effectiveness  of  policies 
and  procedures,  (3)  frequency  and  sufficiency  of  the  contractor's  management  reviews, 
(4)  timely  processing  of  offsets,  and  (5)  exclusion  of  non-billable  items  from  government 
billings.  Although  the  audit  was  performed  from  November  2004  through  J  uly  2005, 
according  to  the  workpapers,  the  auditor  tested  a  nonstatistical  selection  of  four 
vouchers  (invoices)  totaling  $2.3  million  that  were  all  processed  on  the  same  day— 
February  28,  2005.  The  workpapers  contained  no  documentation  on  the  population  of 
invoices  or  the  basis  for  selecting  four  vouchers  fortesting  that  were  all  processed  on 
the  same  day  out  of  the  8-month  period  covered  by  the  audit.  GAO  also  determined 
that  the  auditors  performed  no  testing  of  the  contractor's  billing  system  information 
technology  (electronic  data  processing)  controls.  As  a  result,  this  audit  can  not  be  relied 
on  for  assurance  that  the  contractor's  billing  system  and  related  internal  control  policies 
and  procedures  were  adequate  as  ofj  une  16,  2005. 


Audit  Supervision  GAGAS  require  that  assistants  (audit  staff)  be  properly  supervised  and  that 

Problems  audit  documentation  contain  evidence  of  supervisory  reviews  of  the  work 

performed  that  supports  findings,  conclusions,  and  recommendations 
contained  in  the  report  before  the  report  on  the  attestation  engagement  is 
issued.^'  Although  workpaper  documentation  for  the  majority  of  the  37 
audits  of  contractor  internal  control  systems  we  reviewed  evidenced 
supervisory  review,  we  found: 


•  A  lack  of  proper  documentation  of  supervisory  review  in  13  audits.  For 
example,  for  an  Eastern  Region  accoimting  system  audit,  the 
supervisory  auditor  who  signed  the  audit  report  did  not  review  key 
workpapers  related  to  accounting  system  transaction  processing  and 
transaction  testing  and  cost  allocations  until  1  to  2  days  after  the  audit 
report  was  issued.  This  was  similar  to  a  situation  we  found  in  our  prior 
investigation,  when  supervisors  at  one  DCAA  field  office  frequently 
reviewed  the  workpapers  for  forward  pricing  reports  after  the  reports 
were  issued.  The  auditors  also  performed  insufficient  testing  on  this 
audit. 

•  Audit  steps  were  deleted  from  the  standard  audit  program  in  an 
accounting  system  audit  and  a  billing  system  audit  after  the  supervisors 
approved  the  audit  programs.  The  supervisors  did  not  ensure  that  the 
deleted  steps  were  addressed  or  that  documentation  was  added  to  the 


GAO-03-673G,  §§  6.04a  and  6.24e. 
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workpapers  to  explain  the  reasons  why  the  related  audit  procedures 
were  not  performed. 

•  For  six  other  audits,  audit  documentation  shows  that  the  supervisors 
and  FAO  managers  extended  the  audit  time  frames  while  contractors 
took  actions  to  correct  significant  deficiencies.  The  audit  reports  were 
issued  1  to  2  years  later  with  adequate  (“clean”)  opinions  on  controls. 
Although  this  raises  serious  auditor  independence  and  reporting  issues 
because  identified  deficiencies  were  not  reported,  we  are  highlighting 
these  cases  under  our  discussion  of  poor  supervision  to  also 
demonstrate  the  importance  of  “tone  at  the  top.” 


DCAA  Extended  Audit  and  “Scrubbed”  Audit  Documentation  after  Contractor 
Objected  to  Findings 

A  DCAA  Western  Region  FAO  failed  to  provide  proper  supervision  of  auditors  throughout 
an  accounting  system  audit  of  one  of  DOD's  five  largest  contractors  working  in  Iraq.  For 
contractor  fiscal  year  ended  December  31,  2004,  the  contractor  reported  over  $900 
million  in  sales  of  which  98  percent  related  to  government  contracts,  including  $250 
million  for  work  in  Iraq.  The  2004  audit,  which  was  initiated  in  November  2003,  was 
transferred  among  several  auditors  and  at  least  three  supervisors  before  its  completion 
and  August  2006  publication.  In  September  2005,  the  contractor  objected  to  draft 
findings  and  recommendations  that  included  eight  significant  deficiencies  in  the  design 
and  operation  of  the  contractor's  accounting  system,  including  inadequate  system 
access  controls,  lack  of  policies  and  procedures  for  segregation  of  duties,  lack  of 
periodic  reconciliations  of  cost  accounts  to  the  general  ledger,  and  insufficient  cost 
ledger  information  on  total  base  costs  by  contract  and  cost  elements  for  applying  indirect 
rates.  The  contractor  stated  that  the  auditors  did  not  fully  understand  the  new  policies 
and  procedures  that  were  just  being  developed  for  the  fast  track  effort  in  Iraq. 

Following  the  contractor's  objections,  the  auditors  revised  and  deleted  some  workpapers 
and  created  new  workpapers.  GAO's  review  of  the  audit  documentation  identified  several 
workpapers  that  were  indexed  to  supporting  documentation  that  no  longer  existed. 
Further,  the  auditors  told  GAO  that  because  they  had  difficulty  finding  support  for  Iraq 
vouchers,  they  relied  on  voucher  reviews  performed  under  other  DCAA  audits.  GAO  also 
found  evidence  in  the  audit  documentation  that  the  final  supervisor  instructed  the  final 
lead  auditor  to  insert  the  signature  of  a  prior  supervisor  on  an  electronic  workpaper  after 
it  had  been  revised,  thereby  making  it  appear  that  the  prior  supervisor  had  approved  the 
workpaper  revisions. 

On  August31,  2006,  after  "scrubbing"  the  audit  documentation  atthe  supervisor's 
request,  dropping  five  significant  deficiencies  and  downgrading  three  significant 
deficiencies  to  suggestions  for  improvement,  DCAA  reported  an  adequate  ("clean") 
opinion  on  the  contractor's  accounting  system.  Waiting  to  review  audits  with  significant 
deficiencies  until  the  end  of  the  job  after  the  work  has  been  completed,  raises  questions 
about  proper  and  timely  supervision.  The  audit  supervisor,  who  authorized  the  electronic 
recording  of  the  prior  supervisor's  name  on  the  audit  documentation  and  supervised  the 
issuance  of  the  audit  report,  was  subsequently  promoted  to  be  the  Western  Region 
Quality  Assurance  Manager,  where  he  went  on  to  act  as  a  quality  control  check  over 
thousands  of  audits—  including  several  of  the  audits  investigated  in  GAO 's  prior  work. 
Following  GAO's  review,  DCAA  rescinded  the  audit  report  on  December  2,  2008. 
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Audit  reports  are  DCAA’s  principal  work  product.  According  to  GAGAS, 
audit  reports  should,  among  other  criteria,  (1)  identify  the  subject  matter 
being  reported,  the  criteria  used  to  evaluate  the  subject  matter,  the 
conclusion  or  opinion,  and  state  that  the  opinion  was  as  of  a  certain  date; 
(2)  include  a  statement  of  the  nature  and  scope  of  the  work  performed  and 
state  that  the  audit  was  performed  in  accordance  with  GAGAS;  (3) 
disclose  any  reservations  about  the  engagement,  including  any  scope 
limitations;  (4)  state  the  intended  use  of  the  report,  if  limited;  and  (5)  state 
the  time  frame^^  covered  by  the  audit.  Our  review  of  audit  documentation 
and  DCAA  final  audit  reports  determined  that  none  of  the  37  DCAA 
reports  on  contractor  systems  internal  controls  met  these  reporting 
standards,  for  example: 

•  The  reports  did  not  cite  the  specific  criteria  used  in  individual  audits. 
Criteria  represent  the  laws,  regulations,  contracts,  grant  agreements, 
standards,  measmes,  expected  performance,  defined  business 
practices,  and  benchmarks  against  which  performance  is  compared 
and  evaluated.  Criteria  identify  the  required  or  desired  state  or 
expectation  with  respect  to  the  program  or  operation  and  provide  a 
context  for  evaluating  evidence  and  understanding  the  findings. 

Instead,  the  DCAA  reports  uniformly  used  boilerplate  language  to  state 
that  DCAA  audited  for  compliance  with  the  “FAR,  CAS,  DFARS,  and 
contract  terms.”  As  a  result  the  user  of  the  report  does  not  know  the 
specific  Federal  Acquisition  Regulation  (FAR),  Cost  Accounting 
Standards  (CAS),  or  contract  terms  used  as  criteria  to  test  contractor 
controls.  This  makes  it  very  difficult  for  users  of  the  reports  to 
determine  whether  the  report  provides  the  level  of  assurance  needed 
to  make  contract  management  decisions.  In  addition,  audit 
documentation  for  many  of  the  audits  we  reviewed  did  not  identify  the 
audit  work  performed  to  provide  assurance  that  contractors  complied 
with  specific  requirements  in  CAS,  FAR,  DFARS,  or  contract  terms. 

•  Six  of  the  37  audit  reports  were  not  issued  at  the  time^'‘  the  work  was 
completed.  These  reports  were  issued  from  8  months  to  over  2  years 
after  the  audits  were  completed.  Frequently,  we  found  that  the  delays 
were  the  result  of  serious  findings,  which  led  DCAA  to  withhold 


AICPA,  Standards  for  Attestation  Engagements,  AT  §101.63  incorporated  by  reference 
in  GAO-03-673G,  §  6.01,  and  GAO-07-731G,  §  6.01. 

GAO-07-731G,  §  7.37. 

GAO-03-673G,  §§  6.50  and  6.24,  and  GAO-07-731G,  §  6.24. 
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issuance  of  the  report  while  the  contractor  addressed  the  problems. 
Because  testing  was  not  updated  or  was  not  sufficiently  updated,  the 
reported  audit  opinions,  which  related  to  controls  at  the  time  the 
reports  were  issued,  were  not  adequately  supported  and  may  have 
been  inaccurate. 

•  The  audit  reports  stated  the  period  during  which  the  audit  was 
performed  but  did  not  disclose  the  scope  and  timing  for  tests  of 
vouchers,  transactions,  or  control  attributes.  Some  tests  covered  a  few 
days  in  only  one  month  or  a  3-month  period  and  did  not  test  controls 
across  the  year  audited.  As  a  result,  testing  did  not  support  the 
reported  audit  opinions  as  of  the  report  dates. 

•  Contractors  imposed  restrictions  on  the  scope  of  four  audits  by 
denying  DCAA  access  to  certain  records.  The  access-to-records  issues 
were  not  fully  resolved  or  disclosed  by  the  auditors. 

•  The  scope  of  33  audits  was  limited  by  DCAA  imposed,  or  implied, 
restrictions,  including  inadequate  audit  resources,  unclear  audit 
guidance  on  nature  and  extent  of  testing,  and  time  constraints  that 
prevented  auditors  from  performing  sufficient  work  to  support 
reported  opinions  on  contractor  internal  controls.  DCAA  officials  told 
us  that  DCAA  does  not  have  sufficient  resources  to  perform  full-scope 
audits  of  contractor  internal  controls. 

Failure  to  issue  reports  when  sufficient  evidence  has  been  obtained  to 
support  an  auditor’s  conclusion  puts  decision  makers  at  risk  of  relying  on 
out-dated  or  inaccurate  information.  Also,  when  DCAA  auditors  do  not 
perform  the  scope  of  work  necessary  to  support  the  reported  audit 
opinions,  the  audit  reports  provide  a  false  level  of  assurance.  Following 
our  discussion  of  these  audits  with  DCAA  headquarters  officials,  DCAA 
rescinded  4  of  the  6  audit  reports  that  did  not  accurately  relate  the  period 
of  testing  to  the  audit  opinion,  and  it  rescinded  18  audit  reports  where  the 
scope  of  work  did  not  support  the  audit  opinions.  The  discussion  below 
describes  a  particularly  egregious  example  of  this  problem. 
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Two  Years  after  Testing  Controls,  DCAA  Reported  the  Results  of  an  Audit  of  a 
Multibillion  Dollar  Contractor’s  Billing  System 

In  J  uly  2003,  DCAA  initiated  a  billing  system  audit  of  a  contractor  doing  business  in  Iraq 
with  sales  of  $6.3  billion  at  the  two  divisions  under  audit.  More  than  2  years  after 
performing  test  procedures  and  after  spending  1,025  hours  on  the  audit,  the  FAO 
issued  an  opinion  that  the  contractor's  billing  system  controls  were  adequate  as  of 
August  31,  2005,  without  updating  the  testing. 

In  2003,  DCAA  auditors  tested  38  vouchers  submitted  for  payment  within  a  12-day 
period.  DCAA  auditors  identified  numerous  billing  errors,  including  two  instances  where 
billings  did  not  comply  with  the  Federal  Acquisition  Regulation  (FAR).  On  August  12, 
2004,  DCAA  auditors  prepared  a  draft  report  with  an  adequate  opinion  and  three 
suggestions  for  improvement.  DCAA  auditors  did  not  perform  testing  in  2004  or  in  2005 
despite  the  number  of  errors  found  as  a  result  of  limited  test  procedures  performed  in 
2003.  As  a  result,  the  evidence  does  not  support  the  opinion  that  the  contractor's  billing 
system  controls  are  adequate  as  of  August31,  2005.  Additionally,  there  is  no  evidence 
in  the  workpapers  that  the  contractor  resolved  the  errors  DCAA  identified  and  the 
underlying  system  deficiencies  that  caused  those  errors.  This  is  of  special  concern 
because  billing  errors  and  system  deficiencies  at  this  contractor  put  multiple  agencies 
at  risk.  For  example,  this  contractor  does  work  not  only  for  DOD  but  also  for  the 
Departments  of  Agriculture,  Commerce,  Interior,  and  NASA,  and  several  other 
agencies. 

The  lead  auditor  told  us  that  this  audit  was  delayed  because  numerous  auditors  were 
assigned  over  the  course  of  this  audit,  and  the  contractor's  work  in  Iraq  took 
precedence  over  this  audit.  Flowever,  we  found  no  evidence  supporting  a  decision  not 
to  issue  this  report  when  the  testing  was  completed  in  2003.  Following  GAO's  review, 
DCAA  rescinded  the  audit  report  on  April  7,  2009. 
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DCAA  performs  assignments  that  are  designed  to  test  various  contractor 
costs  as  allowable,  reasonable  under  the  related  contracts,  the  Federal 
Acquisition  Regulation  (FAR),  and  Cost  Accounting  Standards  (CAS). 
Although  DCAA  uses  the  term  “audit”  generically,  some  of  these 
assignments  are  audits  and  other  assignments  relate  to  financial  and 
advisory  services.  We  reviewed  32  cost-related  assignments  ‘  performed  by 
seven  geographically  disperse  field  audit  offices  (FAO)  across  the  five 
DCAA  regions  (the  same  offices  as  in  appendix  I)  to  assess  whether  (1)  the 
tests  of  contractor  costs,  billings,  and  payments  were  effective  in 
identifying  overpayments,  billing  errors,  and  unallowable  cost^  and 
(2)  DCAA  identified  and  reported  unallowable  and  unsupported  costs, 
overpayments,  and  billing  errors  so  that  the  government  was  in  a  position 
to  collect  or  recover  improper  costs  and  billings  through  refunds,  contract 
adjustments,  or  offsets.  The  32  DCAA  cost-related  assignments  we 
reviewed  included  16  paid  voucher  reviews,  10  overpayment  assignments, 

4  incurred  cost  audits,  and  2  request  for  equitable  adjustment  (REA) 
audits.^  Although  DCAA  performs  incurred  cost  and  REA  audits  as 
engagements  in  accordance  with  generally  accepted  auditing  standards 
(GAGAS),  DCAA  does  not  consider  paid  voucher  reviews  or  overpayment 
audits  to  be  GAGAS  assignments.  DCAA  performed  the  paid  voucher 
reviews  to  assess  the  accuracy  of  contractor  billings  to  support  decisions 
to  approve  contractors  for  participation  in  the  direct-bill  program,^ 
whereby  the  contractor  submits  invoices  directly  to  a  federal  agency 
paying  office  without  government  review  of  the  invoices  prior  to  payment. 
Overpayment  assignments  review  contractor  controls  for  identifying  and 


^  We  initially  selected  34  cost-related  audit  assignments  for  review.  After  reviewing  the 
audit  documentation,  we  determined  that  one  assignment  only  covered  part  of  an  audit  and 
the  other  assignment  was  terminated  and  the  procedures  were  incorporated  into  a  related 
hilling  system  audit.  Therefore,  we  reviewed  a  total  of  32  completed  cost-related 
assignments. 

^  Contractor  overpayments  can  occur  as  a  result  of  errors  made  by  paying  offices,  such  as 
duplicate  payments  and  payments  in  excess  of  amounts  billed,  and  contractor  billing 
errors,  such  as  using  the  wrong  overhead  rate,  failing  to  withhold  designated  amounts  on 
progress  payments,  duplicate  billings,  or  billings  for  unallowable  cost.  Recoveries  of 
overpayments  can  be  accomplished  through  refunds,  subsequent  billing  offsets,  or  other 
adjustments  to  correct  billing  errors.  Unallowable  costs  include  lobbying  cost,  certain  legal 
expenses,  executive  and  management  bonuses,  luxury  items,  and  certain  overhead  costs. 

^  REA  relates  to  contractor  requests  to  adjust  contract  terms  for  rates  and  payments 
resulting  from  contract  modifications.  In  the  case  of  the  two  REA  audits,  contract 
modifications  related  to  requests  for  increased  hours  of  service  and  related  labor  and 
materials. 

“  FAR  §  42.101  and  DEARS  §  242.803. 
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refunding,  offsetting,  or  adjusting  contract  overpayments  and  billing 
errors. 

Similarly,  DCAA  performs  overpayment  assignments  at  the  request  of 
contracting  officers  to  determine  (1)  whether  contractor  controls  are 
effective  in  identifying  overpayments  made  by  disbursing  officers  or  over 
billings  and  billing  errors  made  by  contractors  and  (2)  if  contactors  are 
making  timely  refunds,  offsets,  or  adjustments. 

At  the  time  the  32  cost-related  assignments  were  performed,  FAR  §  52.232- 
25(d)  imposed  a  requirement  on  contractors  to  immediately  notify  the 
contracting  officer  and  request  instructions  for  disposition  of  any 
overpayment  when  the  contractor  becomes  aware  of  a  duplicate  or 
overpaid  contract  financing  or  invoice  payment."^  Also,  FAR  32.604(b)(4) 
provides  that  contractors  shall  repay  debts  under  a  demand  letter  wdthin 
30  days,  except  for  certain  debts  covered  by  specific  terms  of  the 
contract.®  This  time  period  is  incorporated  into  most  contracts  under  FAR 
Clause  52.232-17(a).  We  found  that  DCAA  auditors  are  not  consistent 
when  assessing  the  timeliness  of  refunds  and  offsets.  Specifically, 
although  DCAA’s  overpayment  work  program  cites  30  to  60  days  after  the 
overpayment  occurred  as  timely,^  some  DCAA  auditors  considered  90  days 
as  timely  which  effectively  minimized  the  impact  on  the  contractors’  cash 
flow. 

We  also  found  limited  testing  in  the  four  incurred  cost  audits  we  reviewed. 
DCAA  considers  incurred  cost  audits  to  be  GAGAS  attestation 
engagements.  Incurred  cost  audits  examine  contractors’  annual  claims  for 
payment  of  cost  incurred.  DOD  contracting  officers  rely  on  DCAA  incurred 
cost  audits  to  approve  contractor  claims  for  payment.®  DCAA  incurred 
cost  audits  and  proposal  audits  are  the  source  of  most  DCAA  questioned 
costs  and  dollar  recoveries.  Dollar  recoveries  are  based  on  contracting 


®  FAR  52.232-25(d)  was  amended  in  October  2008  to  require  contractors  to  monitor  for  and 
make  adjustments  to  correct  overpayments  they  may  receive,  but  it  still  does  not  specify  a 
timeframe  for  making  any  needed  adjustments. 

®  FAR  32.606(a). 

’’  DCAA,  Audit  of  Contract  Overpayments  Audit  Program,  version  2.1,  October  2006. 

®  Although  the  government  pays  contractor  invoices  on  a  provisional  basis  when  they  are 
submitted  for  payment,  DCAA  incurred  cost  audits  provide  the  basis  for  final  approval  of 
contractor  incurred  costs  claims. 
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officer  agreement  with  DCAA  questioned  costs.”  DOD  contracting  officers 
are  responsible  for  enforcing  DCAA  recommendations  to  disallow 
questioned  cost.  Figure  3  provides  a  comparison  of  costs  questioned  by 
DCAA  auditors  and  questioned  costs  sustained  (recovered)  by  DOD 
contracting  officers. 


Figure  3:  DCAA  Questioned  Costs  and  Amounts  Sustained  by  Contracting  Officers 
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Source:  GAO  analysis  of  DCAA  data. 


For  one  of  the  four  incurred  cost  audits  we  reviewed,  DCAA  rescinded  the 
related  accounting  system  audit  report  in  response  to  concerns  we 
identified  with  that  report.  For  a  second  incurred  cost  audit  we  reviewed, 
DCAA  rescinded  the  related  billing  system  report.  Risk  assessments  for 
determining  the  nature,  extent,  and  timing  of  testing  for  incurred  cost 
audits  are  based  in  part  on  the  results  of  accoimting  and  billing  system 
audits.  Therefore,  a  rescission  of  an  accounting  or  billing  system  audit 


”  Questioned  costs  include  costs  questioned  by  DCAA  auditors  as  unallowable  or 
unsupported. 
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would  call  into  question  the  risk  assessment  performed  for  the  related 
incurred  cost  audits. 

The  case  study  examples  in  table  6  illustrate  significant  problems  we 
identified  with  the  DCAA  cost-related  assignments  we  reviewed.  As 
previously  discussed,  the  level  of  testing  in  these  assignments  was  not 
sufficient  to  identify  all  potential  contractor  billing  errors  and 
overpayments. 


Table  6:  Case  Studies  of  Problem  DCAA  Cost-Related  Assignments 


Region 

Type  of  assignment 

Details  of  review 

Central 

Paid  voucher  review  (2006) 

Non-GAGAS 

For  this  review  of  paid  contractor  Invoices,  the  auditor  relied  on  the  results  of  DCAA's 
2005  billing  system  audit  and  did  not  test  any  Invoices.  The  workpapers  stated  that  the 
auditor  also  relied  on  the  results  of  the  2005  paid  voucher  assignment.  However,  that 
assignment  did  not  test  any  2006  Invoices. 

F  urther,  as  a  result  of  GAO 's  work,  DCAA  had  rescinded  the  2005  billing  system  audit 
report  on  February  10,  2009. 

As  a  result,  there  Is  no  audit  support  for  DCAA's  approval  for  this  contractor  to  directly 
bill  the  government. 

Central 

Paid  voucher 
review  (2005) 

Non-GAGAS 

In  planning  this  work,  the  auditor  Improperly  assessed  risk  as  low  and  deleted  several 
steps  from  the  standard  "audit"  program. 

The  auditor  did  not  Identify  the  population  of  vouchers  (Invoices)  and  selected  two 
Invoices  fortesting,  but  only  tested  one  of  them. 

The  auditor  tested  one  Invoice  to  see  If  the  payment  received  by  the  contractor 
matched  the  amount  billed. 

On  J  anuary  23,  2006,  DCAA  Issued  a  Memorandum  for  the  Record,  stating  "reliance 
can  be  placed  on  the  contractor's  procedures  for  preparation  of  Interim  vouchers. 
Accordingly,  the  contractor  has  met  the  criteria  for  continued  participation  In  the  direct 
billing  program." 

Western 

Paid  voucher 
review  (2005) 

Non-GAGAS 

Without  documenting  the  population  of  vouchers  or  the  total  dollars  billed  during  the 
contractor's  fiscal  year,  the  auditor  tested  8  of  734  vouchers  Issued  from  April  16,  2004, 
through  March  25,  2005. 

The  supervisor  Incorrectly  directed  the  auditor  to  test  a  final  voucher.  Paid  voucher 
assignments  focus  on  Interim  vouchers  as  a  basis  for  making  direct-bill  decisions.  Final 
vouchers  are  submitted  to  close  out  a  contract. 

The  auditor  did  not  Identify  any  errors  In  the  vouchers  tested. 

On  September  30,  2005,  the  auditor  prepared  a  Memorandum  for  the  Record,  stating 
that  "continued  reliance  can  be  placed  on  the  contractor's  procedures  for  preparation  of 
Interim  vouchers.  Accordingly,  the  contractor  has  met  the  criteria  for  continued 
participation  In  the  direct  billing  program." 
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Region  Type  of  assignment 

Eastern  Paid  voucher  review  (2004) 
Non-GAGAS 


Details  of  review 

•  Aithough  the  contractor  generated  $1.1  biiiion  in  annuai  biiiings  to  the  government,  the 
auditor  assessed  risk  as  iow  for  this  assignment.  Without  documenting  the  basis  for  the 
risk  assessment,  the  auditor  judgmentaiiy  seiected  3  vouchers  totaiing  $88,000  for 
testing  out  of  a  totai  of  222  vouchers  submitted  to  the  government  for  payment  from 
March  2003  through  February  2004. 

•  The  auditor  tested  the  first  voucher  seiected  and  performed  iimited  testing  on  the 
remaining  2  vouchers. 

•  The  workpapers  do  not  inciude  any  evidence  to  show  that  the  auditor  performed  most 
of  the  audit  steps  required  in  the  standard  audit  program. 

•  Despite  iimited  testing,  on  March  31,  2004,  DCAA  prepared  a  memorandum  for  the 
record,  stating  "continued  reiiance  can  be  piaced  on  the  contractor's  procedures  for  the 
preparation  of  interim  vouchers"  and  "the  contractor  has  met  the  criteria  for  continued 
participation  in  the  direct  biiiing  program." 


Source:  GAO  analysis  of  DCAA  audit  documentation. 
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Pursuant  to  a  request  from  the  Chairman  and  Ranking  Member  of  the 
Senate  Committee  on  Homeland  Security  and  Governmental  Affairs,  we 
conducted  an  agencywide  performance  audit  to  assess  the  effectiveness  of 
Defense  Contract  Audit  Agency  (DCAA)  audits  for  helping  to  assure  that 
prices  paid  by  the  government  for  needed  goods  and  services  are  fair  and 
reasonable  and  that  contractors  are  charging  the  government  in 
accordance  with  applicable  laws,  regulations,  cost  accounting  standards, 
and  contract  terms.  The  overall  objectives  of  om  work  were  to  (1)  conduct 
a  broad  assessment  of  DCAA’s  management  environment  and  quality 
assurance  structure,  (2)  evaluate  DCAA  corrective  actions  in  response  to 
our  prior  investigation'  and  DOD  Comptroller/CFO  “tiger  team”  and 
Defense  Business  Board  (DBB)  studies,  and  (3)  identify  potential 
legislation  and  other  actions  that  could  improve  DCAA’s  effectiveness  and 
independence. 

To  address  our  first  objective,  we  evaluated  DCAA’s  contract  audit 
guidance  and  policies  and  its  quahty  assurance  program  and  assessed  the 
quality  of  a  nationwide  selection  of  DCAA  audits.  We  evaluated  the  results 
of  internal  DCAA  audit  quality  assurance  reviews  on  audits  issued  from 
fiscal  year  2003  through  2008.  We  also  reviewed  a  total  of  69  DCAA  audits 
and  cost-related  assignments.''  In  reviewing  DCAA  audits,  we  used 
generally  accepted  government  auditing  standards  as  our  criteria."  The  69 
DCAA  audits  and  cost-related  assignments  we  reviewed  included  37  audits 
of  contractor  internal  controls  and  32  cost-related  audits  and  assignments. 
We  did  not  assess  a  statistical  sample  of  DCAA  audits.  Rather,  we  focused 
on  DCAA  offices  that  reported  predominately  adequate,  or  “clean,” 
opinions  on  audits  of  contractor  internal  controls  over  cost  accounting, 
billing,  and  cost  estimating  systems  issued  in  fiscal  years  2005  and  2006.'' 
We  selected  DCAA  offices  that  reported  predominately  adequate  (“clean”) 


'  GAO-08-857. 

"  As  stated  in  DCAA’s  Contract  Audit  Manual,  CAM  2-100,  DCAA  uses  the  term  audit  to 
refer  to  a  variety  of  audits,  evaluations,  reviews,  assessments,  and  analyses. 

"  GAO,  Government  Auditing  Standards:  2003  Revision,  GAO-03-673G  (Washington,  D.C: 
June  2003)  and  Government  Auditing  Standards:  2007  Revision,  GAO-07-731G 
(Washington,  D.C;  July  2007). 

'  In  selecting  the  seven  DCAA  offices,  we  considered  a  2-year  history  of  internal  control 
audit  results.  The  seven  DCAA  offices  we  selected  reported  adequate  opinions  on  89 
percent  or  more  of  the  internal  control  reports  they  issued  during  fiscal  year  2006.  During 
fiscal  year  2006,  four  of  the  seven  offices  reported  adequate  opinions  in  85  percent  or  more 
of  the  internal  control  reports  they  issued,  and  the  other  3  offices  issued  adequate  opinions 
in  50  to  69  percent  of  the  internal  control  audit  reports  they  issued. 
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opinions  on  contractor  systems  and  related  internal  controls  because 
contracting  officers  rely  on  these  opinions  for  three  or  more  years  to  make 
decisions  on  pricing  and  contract  awards,  and  payment.  For  example, 
audits  of  estimating  system  controls  support  negotiation  of  fair  and 
reasonable  prices.^  Also,  the  Federal  Acquisition  Regulation  (FAR) 
requires  contractors  to  have  an  adequate  accounting  system  prior  to  award 
of  a  cost-reimbursable  or  other  flexibly-priced  contract.*^  Billing  system 
internal  control  audit  results  support  decisions  to  authorize  contractors  to 
submit  invoices  directly  to  DOD  and  other  federal  agency  disbursing 
offices  for  payment  without  government  review.^  In  addition,  DCAA  uses 
the  results  of  internal  control  audits  to  assess  risk  and  plan  the  nature, 
extent,  and  timing  of  tests  for  other  contractor  audits.  When  a  contractor 
has  received  an  adequate  opinion  on  its  systems  and  related  controls, 
DCAA  would  assess  the  risk  for  subsequent  internal  control  and  cost- 
related  audits  as  low  and  would  perform  less  testing  on  these  audits. 

Using  this  approach,  we  identified  seven  geographically  disperse  DCAA 
field  offices  within  the  5  DCAA  regions  and  targeted  39  audits  of 
contractor  cost  accounting,  billing,  and  estimating  system  controls  issued 
during  fiscal  years  2004  through  2006  for  review.*^  These  were  the  most 
recent  completed  fiscal  years  at  the  time  we  initiated  our  audit.  Two  of  the 
39  internal  control  audits  we  identified  were  performed  as  assist  audits  to 
a  billing  system  audit  and  we  considered  them  as  part  of  the  billing  system 
audit  we  reviewed.  Therefore,  we  reviewed  a  total  of  37  audits  of 
contractor  internal  controls  for  compliance  with  GAGAS  and  DCAA 
policy.  We  also  considered  whether  DCAA  adequately  applied  internal 
control  standards  in  its  audits  that  are  applicable  to  the  private  sector.®  We 


^  DCAA  Contract  Audit  Manual  (CAM)  5-1202.  la  and  Defense  Federal  Acquisition 
Regulation  Supplement  (DFARS)  §  215.407-5. 

®  FAR  §  16.301-3(a)(l). 

’’  FAR  §  42.101,  and  DFARS  §  242.803. 

*  In  the  case  of  follow-up  audits,  we  also  reviewed  the  documentation  for  the  previous  audit 
to  gain  an  understanding  of  the  scope  of  work  and  deficiencies  previously  identified. 

®  The  Internal  Control  Integrated  Framework  developed  by  the  Committee  on  Sponsoring 
Organizations  (COSO)  of  the  Treadway  Commission,  September  1993,  are  applicable  to 
private  sector  entities.  We  considered  whether  DCAA  audits  addressed  contractor  controls 
related  to  the  five  key  control  activities:  (1)  contractor  control  environment;  (2)  contractor 
risk  assessment;  (3)  control  activities,  including  policies  and  procedures  and  segregation  of 
duties;  (4)  information  and  communication  (i.e.,  information  system  processing  controls); 
and  (5)  monitoring. 
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did  not  review  classified  audits  performed  by  DCAA’s  field  detachment 
office.  Although  our  selection  of  the  seven  offices  and  37  internal  control 
audits  was  not  statistical,  it  represented  about  9  percent  of  the  total  76 
DCAA  offices  that  issued  audit  reports  on  contractor  internal  controls  and 
nearly  18  percent  of  the  40  offices  that  issued  8  or  more  reports  on 
contractor  internal  controls  during  fiscal  year  2006.  Of  the  37  internal 
control  audits  we  reviewed,  32  reports  were  issued  with  adequate  opinions 
and  5  reports  were  issued  with  inadequate-in-part  opinions.  Table  7 
summarizes  the  number  and  types  of  contractor  internal  control  audits  we 
reviewed  for  seven  FAOs  across  the  5  DCAA  regions. 


Table  7:  Summary  of  DCAA  Audits  Reviewed  for  GAGAS  Compliance 


Region/FAO 

Type  of  internal  control  audit 

Total  internal 
control  audits 

Accounting  system 

Indirect  &  other 
direct  cost 

Billing  system 

Estimating 

system 

Northeast 

FAO  #1 

— 

— 

3 

1 

4 

Mid-Atlantic 

FAO  #2 

2 

— 

3 

— 

5 

Eastern 

FAO  #3 

1 

1 

3 

1 

6 

Central 

FAO  #4 

2 

— 

2 

1 

5 

FAO  #5 

2 

— 

5 

— 

7 

Western 

FAO  #6 

— 

1 

3 

1 

5 

FAO  #7 

2 

— 

1 

2 

5 

Total 

9 

2 

20 

6 

37 

Source:  GAO  analysis  of  DCAA  management  information  system  data. 


At  the  same  seven  DCAA  field  offices,  we  selected  34  cost-related 
assignments  performed  during  the  same  period  as  the  internal  control 
audits  we  reviewed  and  analyzed  supporting  documentation  to  determine 
whether  the  assignments  included  sufficient  testing  to  assess  whether 
(1)  the  tests  of  contractor  costs,  billings,  payments  were  effective  in 
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identifying  overpayments,  billing  errors,  and  unallowable  cost“  and 
(2)  DCAA  reported  overpayments,  billing  errors,  and  unallowable  and 
unsupported  costs,  so  that  the  government  was  in  a  position  to  recover 
improper  payments  through  refunds,  contract  adjustments,  or  offsets  and 
avoid  payment  of  unsupported  and  unallowable  costs.  Upon  reviewing 
documentation  for  the  34  cost-related  audits,  we  determined  that  one  of 
these  assignments  covered  the  risk  assessment  portion  of  an  incurred  cost 
audit  and  was  not  a  complete  audit.  Documentation  for  a  second 
assignment  to  test  for  overpayments  was  terminated  and  the  audit 
procedures  were  rolled  into  a  billing  system  audit.  Consequently,  as  shown 
in  table  8,  we  reviewed  a  total  of  32  cost-related  DCAA  assignments.  These 
assignments  included  paid  voucher  reviews  and  overpayment  control 
assignments  and  audits  of  requests  for  equitable  adjustment  (REA)^^  and 
contractor  incurred  cost  claims. 


Table  8:  Summary  of  DCAA  Cost-Related  Assignments  Reviewed 

Type  of  Assignment 

Over  payment 

Region/FAO 

Paid  Voucher  review 

assignment  REA  audit 

Incurred  Cost  audit 

Total  assignments 

Northeast 

FAO  #1 

— 

1 

2 

2 

5 

Mid-Atlantic 

FAO  #2 

4 

1 

— 

1 

6 

Eastern 

FAO  #3 

3 

3 

— 

— 

6 

Central 

FAO  M 

1 

1 

— 

— 

2 

FAO  #5 

5 

2 

— 

— 

7 

Contractor  overpayments  can  occur  as  a  result  of  errors  made  by  paying  offices,  such  as 
duplicate  payments  and  payments  in  excess  of  amounts  billed,  and  contractor  billing 
errors,  such  as  using  the  wrong  overhead  rate,  failing  to  withhold  designated  amounts  on 
progress  payments,  duplicate  billings,  or  billing  for  unallowable  cost.  Recoveries  of 
overpayments  can  be  accomplished  through  refunds,  subsequent  billing  offsets,  or  other 
adjustments  to  correct  billing  errors.  Unallowable  cost  include  lobbying  cost,  certain  legal 
expenses,  executive  and  management  bonuses,  luxury  items,  and  certain  overhead  costs. 

REA  audits  relate  to  reviewing  contractor  requests  for  adjustments  in  billing  rates 
pursuant  to  contract  modifications.  For  example,  if  a  contractor  is  asked  to  provide 
additional  services  or  expand  hours  of  service,  contract  costs  would  need  to  be 
recalculated  and  adjusted  rates  verified.  REA  audits  relate  to  audits  of  contractor 
estimating  system  controls. 
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Type  of  Assignment 

Region/FAO 

Paid  Voucher  review 

Over  payment 
assignment  REA  audit 

Incurred  Cost  audit 

Total  assignments 

Western 

FAO  #6 

3 

1  - 

— 

4 

FAO  #7 

— 

1  - 

1 

2 

Total 

16 

10  2 

4 

32 

Source:  GAO  analysis  of  DCAA  management  information  system  data. 


The  details  of  our  assessments  of  DCAA  audits  of  contractor  internal 
control  systems  and  cost-related  audits  and  assignments  are  included  in 
appendixes  1  and  11,  respectively.  Examples  of  our  findings  are  included  in 
the  body  of  this  report  to  help  illustrate  the  effect  of  our  findings  related  to 
DCAA’s  management  environment. 

To  assess  DCAA’s  management  environment  and  quality  control  system, 
we  reviewed  DCAA’s  mission  statement,  strategic  plan,  performance 
metrics,  quality  assurance  program,  audit  planning  and  policy  guidance, 
and  human  capital  management.  We  evaluated  the  results  of  internal 
DCAA  audit  quality  assurance  reviews  on  audits  issued  from  fiscal  year 
2004  through  2008.  We  used  requirements  in  the  Government  Performance 
and  Results  Act,‘^  GAGAS,  “  and  GAO’s  Standards  for  Internal  Control  in 
the  Federal  Governments^  as  our  criteria. 

We  analyzed  the  findings,  conclusions,  and  recommendations  in  the  DOD 
Inspector  General’s  (IG)  2007  report  on  its  oversight  review  of  DCAA,  s'* 
which  serves  the  purpose  of  a  peer  review.  We  did  not  review  DOD  IG 
documentation  for  the  oversight  review.  In  assessing  the  DOD  IG  peer 
review  conclusions  and  opinion,  we  considered  the  inconsistencies 
between  the  findings  and  recommendations  in  the  IG  report.  In  addition, 
we  considered  the  results  of  our  analysis  of  DCAA  audits  in  our  prior 
investigation;  our  review  of  the  69  DCAA  audits  and  related  assignments 


Pub.  L.  No.  103-62,  107  Stat.  286  (Aug.  3,  1993). 

GAO-03-673G,  and  GAO-07-731G. 

GAO,  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AlMD-2 1.32.1 
(Washington,  D.C.:  November  1999). 

DOD  Inspector  General,  Oversight  Review:  Review  of  the  Defense  Contract  Audit 
Agency  Quality  Control  System,  Report  No.  D-2007-6-006  (Arlington,  VA:  May  1,  2007). 
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covered  in  this  report;  the  results  of  DCAA’s  internal  quality  assurance 
reviews;  and  DCAA’s  actions  to  rescind  80  audit  reports. 

To  achieve  our  second  objective,  we  reviewed  the  status  of  several  key 
actions  that  DCAA  initiated  as  a  result  of  our  earlier  investigation, 
including  efforts  to 

•  revise  DCAA’s  mission  statement  and  strategic  plan  to  focus  on 
protecting  the  public  interest; 

•  change  performance  metrics  to  focus  on  audit  quality  instead  of 
performing  large  quantities  audits; 

•  end  DCAA  involvement  with  integrated  product  teams,  which  we 
identified  as  an  impairment  to  DCAA’s  independence; 

•  improve  audit  quality  by  revising  audit  policy  guidance  and  realigning 
DCAA’s  audit  quality  assurance  structure;  and 

•  update  training  courses  to  reflect  changes  in  DCAA’s  mission,  metrics, 
and  audit  policy. 

Although  the  October  2008  Defense  Business  Board  report  recommended 
that  the  Secretary  of  Defense  revise  DCAA’s  mission  statement  to  focus  on 
protecting  the  public  interest,  at  the  time  we  completed  our  work  in  July 
2009,  DCAA’s  mission  statement  had  not  yet  been  revised.  To  assess 
changes  in  performance  metrics,  we  analyzed  DCAA’s  new  metrics  and 
determined  whether  changes  made  in  September  2008  were  effective  in 
shifting  DCAA  focus  from  report  production  to  performing  quality  audits 
and  if  the  new  metrics  had  been  integrated  into  DCAA’s  performance 
plans,  auditor  expectations,  and  performance  appraisal  standards.  In 
addition,  we  made  selected  calls  to  one  or  more  auditors  in  15  selected 
DCAA  offices  that  were  separate  from  the  offices  we  visited  to  review 
audit  documentation  and  interviewed  auditors  about  their  experience  with 
changes  in  DCAA  policies  and  performance  metrics.  We  also  considered 
34  additional  hotline  allegations  we  received  from  auditors  across  the  5 
DCAA  regions  after  our  investigative  report  was  issued.  We  used  GAGAS 
criteria^  to  assess  the  effectiveness  of  DCAA  policy  changes  and  DCAA’s 
centralization  of  the  audit  quality  function  aimed  at  improving  auditor 
independence  and  audit  quality.  We  used  GAO’s  Internal  Control 


“  GAO-03-673G,  and  GAO-07-731G. 


Page  110 


GAO-09-468  DCAA  Audit  Environment 


Appendix  III:  Objectives,  Scope,  and 
Methodoiogy 


Standards  as  our  criteria  for  assessing  DCAA’s  management  environment, 
culture,  need  for  a  risk-based  audit  approach,  and  human  capital  practices. 

To  achieve  our  third  objective  to  identify  potential  legislative  and  other 
actions  to  improve  DCAA’s  effectiveness,  we  considered  DCAA’s  current 
role  and  responsibilities;  the  framework  of  statutory  authority  for  auditor 
independence  in  the  Inspector  General  Act  of  1978,  as  amended;  best 
practices  of  leading  organizations  that  have  made  cultural  and 
organizational  transformations;  our  past  work  on  DCAA  organizational 
alternatives;^’^  GAGAS  criteria  for  auditor  integrity,  objectivity,  and 
independence;  and  GAO’s  Standards  for  Internal  Control'®  on  managerial 
leadership  and  oversight.  We  identified  potential  short-term  and  longer 
term  legislative  actions  and  organizational  changes  that  could  enhance 
DCAA’s  effectiveness  and  independence. 

Throughout  our  audit  we  met  with  the  DCAA  Director  and  DCAA 
headquarters  policy,  quality  assurance,  and  operations  officials  and  DCAA 
Region  and  FAO  managers,  supervisors,  and  auditors.  We  also  met  with 
DOD  Office  of  Inspector  General  (OIG)  auditors  responsible  for  DCAA 
audit  oversight  and  DOD  IG  hotline  office  staff.  We  assessed  the  reliability 
DCAA  data  used  in  our  work  by  reviewing  DCAA  procedures  for  assuring 
the  reliability  of  reported  performance  data,  discussing  the  compilation 
and  use  of  these  data  with  DCAA  operations  personnel,  and  performing 
analytical  procedures  to  determine  the  reliability  of  specific  data  used  in 
our  analysis.  For  example,  we  determined  that  DCAA  assignments 
initiated  in  one  year  and  completed  in  the  second  year  were  double 
counted.  We  eliminated  duplicate  records  from  data  used  for  our  analysis. 
We  also  met  with  the  former  DOD  Comptroller/CFO  to  discuss  plans  for 
the  Office  of  Comptroller/CFO  and  Defense  Business  Board  reviews,  and 
we  continued  to  meet  with  and  obtain  information  from  the  new  DOD 
Comptroller/CFO  and  his  staff.  We  also  met  with  the  Comptroller’s  new 
DCAA  Oversight  Committee,  which  includes  the  Auditors  General  of  the 
Army,  the  Navy,  and  the  Air  Force;  the  DOD  Director  of  Defense 
Procurement  and  Acquisition  Policy;  and  the  DOD  Deputy  General 
Coimsel  for  Acquisition. 


5  U.S.C.,  App. 

GAO,  Defense  Contract  Audits:  Current  Organizational  Relationships  and 
Responsibilities,  GAO/AFMD-91-14  (Washington,  D.C.:  Apr.  3,  1991). 

GAO/AIMD-00-21.3.1. 
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We  conducted  this  performance  audit  from  August  2006  through 
December  2007,  at  which  time  we  suspended  this  work  to  complete  our 
investigation  of  hotline  complaints  regarding  audits  performed  at  three 
DCAA  field  offices.  We  resumed  our  work  on  this  audit  in  October  2008 
and  performed  additional  work  through  July  2009  to  evaluate  DCAA’s 
quality  assurance  program  during  fiscal  years  2007  and  2008,  assess  DCAA 
corrective  actions,  and  consider  organizational  placement  options.  We 
conducted  our  audit  in  accordance  with  generally  accepted  government 
auditing  standards.  Those  standards  require  that  we  plan  and  perform  the 
audit  to  obtain  sufficient,  appropriate  evidence  to  provide  a  reasonable 
basis  for  our  findings  and  conclusions  based  on  our  audit  objectives.  We 
believe  that  the  evidence  obtained  provides  a  reasonable  basis  for  findings 
and  conclusions  based  on  our  audit  objectives.  We  performed  our 
investigative  procedures  in  accordance  with  quality  standards  set  forth  by 
the  Council  of  the  Inspectors  General  on  Integrity  and  Efficiency  (formerly 
the  President’s  Council  on  Integrity  and  Efficiency). 
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Note:  GAO  comments 
supplementing  those  in 
the  report  text  appear  at 
the  end  of  this  appendix. 


UNDER  SECRETARY  OF  DEFENSE 
I  too  DEFENSE  PENTAGON 
WASHINGTON.  DC  2030 1-1100 

SEP  “4  2009 

COMPTHOU-ER 

Mr.  Gregory  Kutz 

Managing  Director,  Forensic  Audits  and  Special  Investigations 
Government  Accountability  Office  (GAO) 

441  G.  St.,  NW 
Washington,  DC  20548 

Dear  Mr.  Kutz: 

This  is  the  Department  of  Defense  (DoD)  response  to  the  GAO  draft  report  GAO- 
09-468,  “DCAA  AUDITS:  Widespread  Problems  with  Audit  Quality  Require 
Significant  Reform,”  dated  July  3 1 ,  2009  (GAO  code  195099).  We  thank  you  for  the 
opportunity  to  respond  to  the  (JAO  draft  report  and  recommendations.  Those 
recommendations  directed  to  the  DoD  Inspector  General  will  be  provided  directly  by  that 
office  under  separate  cover. 

The  Department  concurs  with  all  but  one  of  the  GAO  recommendations 
(Enclosure  1).  We  disagree  with  some  of  GAO  comments  for  Congressional 
consideration  (Enclosure  2).  Enclosure  3  contains  a  listing  of  corrective  actions  DCAA 
has  implemented  since  2008.  As  part  of  our  review  of  the  GAO  draft  report,  we  noted 
several  areas  where  we  believe  further  clarification  and  explanation  are  needed  so  the 
circumstances  can  be  completely  understood.  The  clarifying  comments  are  provided  in 
Enclosure  4.  Comments  from  the  Director,  Defense  Procurement  and  Acquisition  Policy 
are  provided  as  Enclosure  5. 

The  Department  and  the  Defense  Contract  Audit  Agency  (DCAA)  are  committed 
to  taking  the  necessary  corrective  actions  to  address  the  GAO  findings.  This  office  will 
continue  to  monitor  DCAA  to  ensure  timely  completion  of  critical  actions  to  address  the 
GAO’s  recommendations.  To  assist  with  this  monitoring,  in  March  2009, 1  established  a 
DCAA  Oversight  Committee  to  provide  my  office  advice  and  recommendations  related 
to  the  oversight  of  DCAA.  This  committee  includes  Auditors  General  of  the  Army,  the 
Navy,  and  the  Air  Force;  the  Director  of  Defense  Procurement  and  Acquisition  Policy; 
and  the  DoD  Deputy  General  Counsel  for  Acquisition  and  Technology.  The  committee 
will  assess  DCAA’s  activities,  its  corrective  actions  taken  to  this  and  other  oversight 
reports,  and  identify  any  gaps.  1  have  also  assigned  a  member  of  my  senior  staff  to  assist 
in  the  oversight  efforts. 

We  acknowledge  that  the  draft  GAO  report  raises  serious  issues  that  we  need  to 
continue  to  address.  We  will  continue  to  improve  audit  quality,  especially  for  internal 
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control  audits.  We  will  reassess  the  number  of  audits  that  DCAA  performs  and  ensure 
that  adequate  staffing  is  available  to  conduct  those  audits  in  accordance  with  generally 
accepted  government  auditing  standards  (GAGAS).  We  will  ensure  that  DCAA  has 
adequate  independence.  We  will  also  ensure  that  an  appeals  mechanism  is  created  to 
provide  a  process  for  resolving  disputes  between  DCAA  and  the  contracting 
organizations. 

While  we  acknowledge  that  continued  work  on  these  serious  issues  is  required,  we 
disagree  with  the  suggestion  in  the  GAO  report  that  we  have  not  yet  begun  to  address  the 
wealmesses.  The  GAO  report  states  that  “DoD  and  DCAA  have  not  yet  addressed  the 
fundamental  weaknesses  in  DCAA’s  mission,  strategic  plan,  metrics,  audit  approach,  and 
human  capital  practices  that  have  had  a  detrimental  effect  on  audit  quality.”  We  believe 
that  we  have  begun  to  address  these  issues.  The  audit  assignments  covered  by  this  review 
were  completed  3-5  years  ago,  several  years  before  DCAA  implemented  a  series  of 
corrective  actions  beginning  in  late  2008.  Although  a  significant  number  of  short-term 
actions  have  been  completed,  DCAA  has  many  long-term  actions  still  in-process.  It  may 
take  several  years  to  experience  the  full  effect  on  the  execution  of  the  DCAA  audits. 
Enclosure  3  contains  the  list  of  corrective  actions  DCAA  has  implemented  in  late  2008 
and  to-date  in  2009. 

While  we  acknowledge  GAO’s  findings  are  serious,  DCAA  has  and  continues  to 
play  a  vital  role  in  support  of  the  contracting  process  in  ensuring  that  DoD  pays  a  fair  and 
reasonable  price  in  accordance  with  applicable  regulations  in  protecting  the  taxpayers’ 
dollars.  In  FY  2008  alone,  DCAA  audits  recommended  reductions  in  proposed  or  billed 
costs  of  $17.9  billion  (referred  to  as  questioned  costs)  and  $7.2  billion  in  estimated  costs 
where  the  contractor  did  not  provide  sufficient  information  to  explain  the  basis  of  the 
estimated  amounts  (referred  to  as  unsupported  costs).  Additionally,  the  current  Director 
of  Defense  Procurement  and  Acquisition  Policy,  a  key  DCAA  stakeholder,  has  stated  that 
he  finds  DCAA’s  work  critical  to  the  acquisition  process  (Enclosure  5). 

DCAA’s  important  work  was  showcased  in  three  hearings  of  the  Commission  on 
Wartime  Contracting  in  2009.  One  hearing  focused  on  contractor  business  systems,  a 
type  of  audit  that  is  the  subject  of  the  GAO  report.  Through  June  2009,  DCAA  has  cited 
deficiencies  in  contractor  systems  in  over  half  of  the  200  audits  performed  on  the 
contractors  performing  effort  in-theater.  The  Commission  rematked  that  hundreds  of 
millions  of  dollars  have  been  recovered  as  a  result  of  DCAA’s  audits  and  that  DCAA’s 
efforts  were  extraordinary  considering  the  performance  of  audits  in  a  war  zone.  Several 
of  the  Commissioners  remarked  during  a  recent  hearing  that  DCAA  was  the  finest  audit 
organization  they  had  worked  with  and  the  most  forthright  and  responsive  of  all  the 
organizations  that  have  interacted  with  the  Commission  to  date. 
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Several  of  the  key  actions  DCAA  has  taken  to  address  DCAA’s  management 
environment  involved  the  use  of  external  organizations  to  guide  DCAA  through  its 
“cultural  transformation.”  For  example,  DCAA  has  engaged  the  Naval  Post  Graduate 
School’s  Center  for  Defense  Management  Reform  to  assist  with  the  development  and 
execution  of  various  long-term  organizational  improvement  projects.  These  projects 
address  the  following  questions: 

1 .  How  ean  DCAA  put  people  first  to  guide  its  deeisions,  actions  and 
values?  For  example,  how  can  DCAA  place  an  increased  emphasis  on 
“soft  skills”  such  as  building  morale  and  developing  employees  (in 
terms  of  a  broad  understanding  as  well  as  technieal  profieiency)? 

2.  How  can  DCAA  develop  leaders  to  serve  the  employees  and  the 
organization? 

3.  How  can  DCAA  structure  the  organization  to  facilitate  eompliance  with 
GAGAS,  maximize  audit  results/retum  on  investment  (ROI),  and  better 
align  Agency  workload/resources? 

4.  How  can  DCAA  identify  and  resolve  differing  stakeholder  expectations 
with  contracting  officers,  contractors,  the  public  (Congress),  and 
external  review  organizations? 

DCAA  has  also  engaged  the  Army  Force  Management  Support  Agency  (AFMSA) 
to  assess  DCAA’s  risk-based  audit  requirements  planning  process  for  FY  2010.  AFMSA 
will  also  assist  in  translating  the  requirements  planning  into  staffing  needs. 

One  of  the  major  findings  reported  by  the  GAO  is  the  lack  of  sufficient  transaction 
testing  to  support  the  conclusions  when  giving  an  opinion  on  contractor  internal  control 
systems.  We  concur  that  many  of  the  assignment  working  papers  did  not  reflect  the  level 
of  testing  required  by  the  GAO  to  opine  on  the  system  of  internal  controls.  DCAA  has 
rescinded  audit  reports  and  initiated  full  seope  internal  control  audits  at  these  loeations. 

In  light  of  the  GAO’s  findings,  DCAA  will  be  assessing  the  need  to  opine  on  contractor 
internal  controls  or  whether  an  opinion  on  the  sufficiency  of  the  contractors’  business 
systems  for  Government  contracting  purposes  is  appropriate.  We  suggest  that  the  GAO 
and  the  DoD  Inspeetor  General  (IG)  work  closely  with  DCAA  in  its  assessment  and 
redesign  of  testing  procedures  for  opining  on  contractor  business  systems. 

It  is  worth  noting  that  the  additional  transaction  testing  will  require  an  increase  in 
audit  staff  at  DCAA.  Some  of  the  increase  is  already  underway  through  the  use  of  the 
Defense  Acquisition  Workforce  Development  Fund.  Using  this  fund,  DCAA  has 
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increased  staffing  by  300  in  FY  2009  and  plans  to  increase  by  an  additional  200  each  in 
F  Ys  20 1 0  and  2011,  with  a  total  increase  of  700  by  the  end  of  FY  20 1 1 .  However,  this 
may  not  be  enough  to  accomplish  the  audits  required  by  regulation  in  light  of  the 
additional  testing  stipulated  by  the  GAO.  We  will  continue  to  monitor  the  staffing 
situation  at  DCAA.  But  to  accomplish  the  significant  increase  in  testing  during  internal 
control  audits,  DCAA  will  be  required  to  defer  lower  risk  assignments  to  FYs  2010  and 
2011,  which  could  have  a  negative  impact  on  the  timely  closing  of  contracts  prior  to  the 
cancelation  of  funds.  The  overall  issue  of  risk  assessment,  as  outlined  in  the  GAO  draft 
report,  is  one  of  the  main  discussion  topics  I  have  assigned  to  the  DCAA  Oversight 
Committee. 

The  Department  concurs  with  the  GAO  that  the  root  causes  for  many  of  the 
GAGAS  noncompliances  related  to  the  prior  DCAA  performance  measures.  As  the  GAO 
acknowledges,  in  September  2008,  DCAA  took  aggressive  action  by  revising  the 
performance  measures  to  promote  quality  audits.  During  FY  2009,  DCAA  has 
continually  assessed  the  performance  measures  by  conducting  focus  groups  in  several 
regions  (including  the  DCAA  Western  Region).  In  general,  the  focus  groups  confirmed 
that  there  was  much  less  emphasis  on  performance  measures  than  in  the  past. 

The  GAO  draft  report  states  that  DCAA  has  taken  some  actions  to  improve  its 
quality  assurance  program;  however,  it  stated  that  staffing  difficulties  and  other  issues 
have  left  the  outcome  of  this  important  initiative  uncertain.  We  disagree.  DCAA  has 
been  proactive  in  standing  up  its  new  Integrity  and  Quality  Assurance  Directorate  - 
essentially  a  new  quality  assurance  organization  that  reports  directly  to  the 
Director/Deputy  Director.  DCAA  has  revised  its  quality  assurance  program  for  reporting 
GAGAS  noncompliances  and  requires  audit  offices  to  provide  corrective  action  plans  that 
address  all  GAGAS  noncompliances  reported.  The  Headquarters  Quality  Assurance 
organization  will  follow-up  on  each  systemic  noncompliance  to  ensure  the  field  audit 
offices  have  corrected  their  processes.  In  July  2009,  DCAA  was  authorized  a  Senior 
Executive  Service  position  to  lead  the  Quality  Assurance  Directorate.  We  believe  the 
extensive  overhaul  of  the  quality  assurance  function  accomplished  in  FY  2009  will 
mitigate  the  prior  shortcomings  in  audit  quality  cited  by  the  GAO. 

In  January  2009,  the  DCAA  Director  established  a  Senior  Advisory  Council  for 
Improvement  which  is  led  by  the  Director  and  comprised  of  Headquarters  senior 
executives.  The  Council’s  primary  purpose  is  to  establish  and  monitor  the  actions  in 
response  to  the  report  issued  in  January  2009  by  the  Independent  Review  Panel  to  the 
Defense  Business  Board  and  findings  from  the  GAO  and  DoD  IG  reviews.  The 
establishment  of  this  council  exemplifies  the  Director’s  efforts  in  ensuring  key  Agency¬ 
wide  actions  are  managed  at  the  Headquarters  level  versus  the  regional  level.  We  believe 
the  establishment  of  this  DCAA  Headquarters  council,  in  addition  to  re-aligning  the 
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Quality  Assurance  Program  to  report  directly  to  the  Director/Deputy  Director,  results  in 
significant  progress  toward  addressing  the  GAO’s  concerns  with  DCAA’s  “decentralized 
structure  that  has  fostered  a  culture  of  DCAA  region  autonomy.” 

The  GAO  draft  report  states  that  the  supervisors  responsible  for  deficient  audits 
identified  in  GAO’s  prior  investigation  were  promoted  even  though  the  GAO 
investigation  disclosed  significant  GAGAS  noncompliances  with  the  audits  they 
supervised.  The  GAO  states  that  “despite  these  findings,  we  found  no  evidence  that 
supervisors  and  auditors  who  did  not  follow  GAGAS  and  DCAA  policy  were  disciplined, 
counseled  or  required  to  take  additional  training.”  DCAA  has  required  several  of  the 
supervisors  to  take  additional  supervisory  and  management  training  courses.  They  have 
completed  some  of  these  courses  and  are  scheduled  to  take  additional  training  in  the  next 
fiscal  year.  Based  on  advice  provided  by  the  DoD  Washington  Headquarters  Services 
Office  of  General  Counsel,  DCAA  did  not  take  performance  or  conduct  actions  against 
these  supervisors.  Additionally,  all  DCAA  employees,  including  the  employees  involved 
in  the  GAO’s  2008  hotline  investigation,  have  completed  annual  training  on  auditor 
“independence”  and  training  in  audit  quality,  including  GAGAS,  at  mandatory  stand- 
down  days  in  August  2008  and  2009. 

We  appreciate  the  recommendations  made  by  the  GAO.  We  believe  the 
implementation  of  these  recommendations  along  with  the  many  actions  that  the 
Department  and  DCAA  have  already  completed  will  improve  DCAA  culture  and 
management  environment  to  ensure  taxpayer  dollars  are  protected  and  DoD  audit  needs 
are  met.  DoD  and  DCAA  leaders  are  committed  to  maintaining  a  strong  contract  audit 
function. 

My  point  of  contact  on  this  matter  is  Mr.  M.  Wayne  Goff.  He  can  be  reached  by 
e-mail  at  wayne.gofr@osd.mil  or  by  telephone  at  703-602-0374. 

Sincerely, 

Robert  F.  Hale 

Enclosures: 

As  stated 
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GAO  DRAFT  REPORT  DATED  JULY  3 1 , 2009 
GAO-09-468  (GAO  CODE  195099) 


‘DCAA  AUDITS:  WIDESPREAD  PROBLEMS  WITH  AUDIT  QUALITY 
REQUIRE  SIGNIFICANT  REFORM” 

DEPARTMENT  OF  DEFENSE  COMMENTS 
TO  THE  GAO  RECOMMENDATIONS 


RECOMMENDATION  1:  The  GAO  recommends  that  the  Secretary  of  Defense  revise 
the  Defense  Contract  Audit  Agency’s  (DCAA)  mission  statement  to  reflect  the  need  for 
quality  contract  audits  and  related  nonaudit  services  that  take  into  account  serving  the 
public  interest. 

POD  RESPONSE:  Concur.  The  Department  is  currently  seeking  final  coordination  on  a 
revised  DCAA  mission  statement  which  is  included  in  an  updated  DoD  Directive 
5105.36,  DCAA. 

RECOMMENDATION  2:  The  GAO  recommends  that  the  Secretary  of  Defense  require 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  establish  milestones  for 
completing  DCAA  corrective  actions  and  monitor  and  regularly  report  on  DCAA 
progress  to  assure  timely  completion  of  critical  actions. 

DOD  RESPONSE:  Concur.  The  Department  will  continue  to  establish  milestones  for 
completing  DCAA  corrective  actions.  DCAA  already  provides  USD(C)  a  monthly  status 
report  of  the  actions  taken  in  response  to  the  recommendations  made  by  the  Independent 
Review  Panel  of  the  Defense  Business  Board  as  well  as  recommendations  from  various 
GAO  and  DoD  IG  reviews.  DCAA  will  expand  its  improvement  plan  to  incorporate  the 
GAO’s  recommendations.  USD(C)  has  assigned  a  senior  staff  member  to  assist  in 
oversight  and  has  created  the  DCAA  Oversight  Committee,  including  all  three  auditors 
general  from  the  Services,  the  OSD  Deputy  General  Counsel  for  Acquisition  and 
Logistics,  and  the  Director  of  Defense  Procurement  and  Acquisition  Policy,  to  assist  in 
oversight  efforts. 

RECOMMENDATION  3:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  Defense 
Contract  Audit  Agency  (DCAA)  in  concert  with  the  revised  mission  statement,  develop  a 
Strategic  Plan  with  short-term  and  long-term  outcome-related  goals. 

DOD  RESPONSE:  Concur.  DCAA  has  already  started  developing  a  revamped  Strategic 
Plan  with  short-term  and  long-term  outcome-related  goals  that  is  in  concert  with  the 
proposed  mission  statement.  Assuming  the  revised  mission  statement  will  be  approved 
by  about  October  2009,  DCAA  is  expected  to  complete  its  strategic  plan  by  November 
30,  2009  for  publication  and  dissemination  to  the  DCAA  workforce. 
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RECOMMENDATION  4:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  DCAA 
to  measure  progress  in  achieving  strategic  goals,  ensure  that  metrics  tie  to  the  revised 
mission  statement  and  strategic  plan  and  support  the  agency’s  annual  work  plan. 

POD  RESPONSE:  Concur.  USD(C)  will  require  DCAA  to  measure  progress  in 
achieving  strategic  goals.  Once  DCAA’s  revised  mission  statement  and  strategic  plan  are 
finalized,  USD(C)  will  require  DCAA  to  ensure  that  DCAA  performance  measures  tie  to 
the  revised  mission  statement  and  strategic  plan  and  support  the  Agency’s  annual  work 
plan. 

RECOMMENDATION  5  :  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  DCAA 
to  consult  with  DoD  stakeholders  and  engage  outside  experts  to  develop  a  risk-based 
contract  audit  approach  that  identifies  resource  requirements,  and  focuses  on  performing 
quality  audits  that  meet  generally  accepted  government  auditing  standards  (GAGAS). 

DOD  RESPONSE:  Partially  Concur.  The  majority  of  DCAA  audits  and  other  services 
are  required  by  laws  and  regulations  as  outlined  in  the  GAO  draft  report.  DCAA  already 
has  a  risk-based  contract  audit  approach  in  identifying  resource  requirements.  DCAA 
performs  atmual  audit  requirements  planning  procedures  to  establish  staffing 
requirements  based  on  its  regulatory/statutory  audit  requirements  and  audit  risk.  An 
example  of  DCAA’s  risk-based  audit  approach  for  incurred  cost  audit  requirements  is 
DCAA’s  performance  of  desk  reviews  of  the  low  risk  contractor’s  incurred  costs  on  a 
cyclical  basis  in  lieu  of  performing  a  full  incurred  cost  audit  every  year.  Nevertheless, 
USD(C)  will  task  DCAA  to  coordinate  with  the  Under  Secretary  of  Defense  for 
Acquisition,  Technology,  and  Logistics  to  assess  DCAA  audit  requirements  since  any 
significant  change  in  DCAA  audit  requirements  would  involve  a  change  in  acquisition 
policy.  In  addition,  DCAA  has  engaged  the  Naval  Post  Graduate  School  to  assist  in  its 
“cultural  transformation.”  One  of  the  projects  is  identifying  and  resolving  differing 
stakeholder  expectations  while  ensuring  DCAA  performs  quality  audits  that  meet 
GAGAS.  DCAA’s  efforts  will  include  consulting  with  DoD  stakeholders  and  engaging 
outside  experts  as  part  of  this  project.  The  Department  will  complete  its  assessment  by 
December  2010. 

RECOMMENDATION  6:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  DCAA 
to  establish  an  SES-level  position  with  responsibility  for  audit  quality  assurance  that 
requires  demcmstrated  knowledge  and  experience  in  applying  professional  audit 
standards. 

DOD  RESPONSE:  Concur.  In  August  2008,  DCAA  established  the  position  of 
Assistant  Director,  Integrity  and  Quality  Assurance  with  responsibility  for  DCAA’s 
quality  assurance  program.  On  July  9,  2009,  this  position  was  approved  as  an  SES-level 
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position  and  the  job  announcement  has  been  published.  DCAA  expects  to  fill  this 
position  by  October  2009. 

RECOMMENDATION  7:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  DCAA 
to  establish  a  separate  DCAA  internal  review  organization  to  conduct  critical  internal 
inspector  general  functions,  including  performing  periodic  internal  evaluations  and 
reviews  and  addressing  DCAA  hotline  complaints. 

POD  RESPONSE:  Concur.  DCAA  will  establish  a  separate  internal  review 
organization  to  conduct  critical  internal  inspector  general  functions,  including  performing 
periodic  internal  evaluations  and  reviews  and  addressing  DCAA  hotline  complaints  and 
serve  as  the  Agency’s  ombudsman.  The  new  organization  will  be  established  by 
December  2009. 

RECOMMENDATION  8:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  DCAA 
to  review  DCAA’s  current  portfolio  of  audit  and  nonaudit  services  to  determine  if  any 
should  be  transferred,  or  reassigned  to  another  DoD  agency,  or  terminated  in  order  for 
DCAA  to  comply  with  GAGAS  integrity,  objectivity,  and  independence  requirements. 

DOD  RESPONSE:  Concur.  USD(C)  will  require  DCAA  to  assess  its  current  portfolio 
of  audit  and  nonaudit  services  to  determine  if  any  should  be  transferred,  or  reassigned  to 
another  DoD  agency,  or  terminated  in  order  for  DCAA  to  comply  with  GAGAS  integrity, 
objectivity,  and  independence  requirements.  DCAA  will  report  the  results  of  its 
assessment  to  USD(C)  by  March  2010.  However,  as  stated  above,  the  majority  of  DCAA 
audits  and  non-audit  services  are  required  by  regulation  or  statute.  As  acknowledged  by 
the  GAO  in  its  report,  DCAA  has  already  performed  some  of  this  assessment  resulting  in 
the  elimination  of  DCAA  auditor  participation  as  members  of  Integrated  Product  Teams 
and  Source  Selection  Evaluation  Boards. 

RECOMMENDATION  9:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  DCAA 
based  on  the  risk-based  audit  approach  to  develop  a  staffing  plan  that  identifies  auditor 
resource  requirements  as  well  as  auditor  skill  levels  and  training  needs. 

DOD  RESPONSE:  Concur.  DCAA  is  entering  into  an  agreement  with  the  Army 
Management  Support  Agency  to  evaluate  DCAA’s  requirements  planning  process  and 
resulting  staffing  assessment  for  FY  2010.  The  Army  will  also  provide  an  overall 
opinion  on  the  sufficiency  of  DCAA  staffing  to  provide  audit  coverage  in  line  with  its 
mission  and  strategic  plan  and  fully  comply  with  Generally  Accepted  Government 
Auditing  Standards.  In  addition,  DCAA  has  an  internal  education  specialist  to  provide 
expert  advice  on  DCAA  training  and  an  internal  statistieian  to  provide  expert  advice  on 
statistical  sampling  audit  techniques  and  training. 
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RECOMMENDATION  10:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  DCAA 
to  establish  a  position  for  an  expert  on  auditing  standards  or  consult  with  an  outside 
expert  on  auditing  standards  to  assist  in  revising  contract  audit  policy,  providing  guidance 
on  sampling  and  testing,  and  developing  training  on  professional  auditing  standards. 

POD  RESPONSE:  Concur.  The  USD(C)  will  require  DCAA  to  consult  with  an  outside 
expert  on  auditing  standards  to  assist  in  revising  eontract  audit  poliey,  providing  guidance 
on  sampling  and  testing,  and  developing  training  on  professional  auditing  standards. 

RECOMMENDATION  1 1 :  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  DCAA 
to  revise  DCAA  audit  policy  to  provide  appropriate  guidance  on  what  constitutes 
sufficient  testing  to  comply  with  GAGAS.  U^ate  DCAA’s  Contract  Audit  Manual,  as 
appropriate. 

POD  RESPONSE:  Concur.  USD(C)  will  require  DCAA  to  issue  audit  policy  on  what 
constitutes  sufficient  testing  to  comply  with  GAGAS  and  update  DCAA’s  Contract  Audit 
Manual.  DCAA  will  complete  this  action  by  December  2009. 

RECOMMENDATION  12:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  requite  the  Director  of  the  DCAA 
to  develop  agency  wide  training  on  govenunent  audit  standards.  This  training  should 
emphasize  the  level  of  assurance  intended  by  the  various  types  of  engagements  and 
provide  detailed  guidance  on  auditor  independence,  platming,  fraud  risk,  level  of  testing, 
supervision,  auditor  judgment,  audit  documentation,  and  reporting. 

POD  RESPONSE:  Concur.  DCAA  is  currently  developing  a  revised  training  course  on 
Generally  Accepted  Government  Auditing  Standards.  This  coirrse  will  emphasize  the 
level  of  assurance  intended  by  the  various  types  of  engagements  and  provide  guidanee  on 
auditor  independence,  planning,  fraud  risk,  level  of  testing,  supervision,  auditor 
judgment,  audit  documentation,  and  reporting.  All  DCAA  employees  have  been  notified 
that  they  will  be  required  to  take  this  course  in  FY  2010.  DCAA  is  also  increasing  the 
level  and  complexity  of  GAGAS  training  in  all  courses. 

RECOMMENDATION  13:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  DCAA 
to  conduct  a  comprehensive,  independent  review  of  DCAA’s  revised  audit  quality 
assurance  function.  This  review  should  focus  on  the  consistent  application  of  criteria 
used  for  assessing  audit  quality  and  assuring  timely,  consistent  and  appropriate  reporting 
of  review  results. 

POD  RESPONSE:  Concur.  On  July  30,  2009,  DCAA  requested  the  DoDIG  to  perform 
its  external  quality  review  of  DCAA’s  Quality  Control  System  for  audits  and  attestation 
engagements  for  the  period  ending  September  30,  2009. 
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RECOMMENDATION  14:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  DCAA 
to  make  appropriate  recommendations  to  address  annual  quality  assurance  review 
findings  of  serious  deficiencies  and  GAGAS  noncompliance,  provide  training,  and 
follow-up  to  assure  that  appropriate  corrective  actions  have  b^n  taken. 

POD  RESPONSE:  Concur.  The  DCAA  Integrity  and  Quality  Assurance  organization 
has  already  established  a  process  for  making  recommendations  to  address  annual  quality 
assurance  review  findings  of  serious  deficiencies  and  GAGAS  noncompliance  to  the 
Director  DCAA  on  a  real-time  basis.  Based  on  these  recommendations,  DCAA  will 
ensure  that  any  necessary  training  is  provided  and  appropriate  corrective  actions  have 
been  taken. 

RECOMMENDATION  15:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller/CFO)  to  require  the  Director  of  the  DCAA 
to  establish  policies  and  procedures  to  enstire  that  auditors  who  make  direct  bill  decisions 
are  independent  of  management  employees  who  review  vouchers  of  contractors  not 
eligible  for  the  direct  bill  program,  thereby  reducing  situations  where  DCAA  auditors  are 
encouraged  to  reduce  their  workload  by  approving  contractors  for  the  direct  bill  program. 

POD  RESPONSE:  Nonconcur.  The  Department  believes  that  a  review  of  the 
contractor’s  interim  public  vouchers  is  an  integral  function  of  DCAA’s  continual 
assessment  of  a  contractor’s  billing  system.  A  DCAA  auditor  who  audits  the  contractor’s 
billing  system  (and  potential  subsequent  approval  for  direct  bill)  is  in  the  best  position  to 
review  and  approve  contract  interim  billings  based  on  their  thorough  understanding  of  the 
contractor’s  system.  In  regards  to  the  GAO  concern  that  DCAA  auditors  may  not  report 
findings  to  reduce  their  workload  by  approving  contractors  for  the  direct  bill  program,  the 
Department  believes  the  GAO’s  concerns  are  mitigated  based  on  the  comprehensive 
supervisory  and  audit  manager  reviews.  DCAA  does  not  believe  that  the  approval  of 
interim  vouchers  along  with  the  approval  for  contractors  to  be  on  direct  bill  results  in  a 
lack  of  auditor  objectivity  (see  Enclosure  4,  Comment  8).  It  should  also  be  noted  that 
since  July  2008,  the  munber  of  contractors  on  the  direct  bill  program  have  been  reduced 
by  over  200  contractors  and  segments  of  many  of  the  largest  defense  contractors  have 
been  removed  from  the  direct  bill  program  in  FY  2009.  In  October  2008,  DCAA  issued 
clarifying  guidance  on  contractor  eligibility  to  participate  in  the  direct  bill  program.  This 
memorandum  includes  guidance  on  ensuring  sufficient  testing  is  performed  when 
determining  a  contractor  is  eligible  for  direct  bill. 
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GAO  DRAFT  REPORT  DATED  JULY  31, 2009 
GAO-09-468  (GAO  CODE  195099) 


“DCAA  AUDITS:  WIDESPREAD  PROBLEMS  WITH  AUDIT  QUALITY 
REQUIRE  SIGNIFICANT  REFORM” 

DEPARTMENT  OF  DEFENSE  COMMENTS 
TO  THE  GAO  RECOMMENDATIONS  FOR  CONGRESSIONAL  CONSIDERATION 

RECOMMENDATION  1:  In  the  short  term,  as  DCAA  makes  progress  in  correcting 
fundamental  weaknesses  that  have  impacted  audit  quality.  Congress  could  consider 
enhancing  DCAA  reform  efforts  by  enacting  legislation  to  grant  it  protections  and 
authorities  similar  to  those  embodied  in  the  Inspector  General  Act,  as  amended. 

POD  RESPONSE:  Nonconcur.  DoD  generally  opposes  providing  DCAA  with 
authorities  similar  to  those  eontained  in  the  Inspector  General  Act.  DoD  specifically 
opposes  certain  recommendations  based  on  the  IG  model.  We  do  not  believe  that  the 
DCAA  Director  should  be  a  Senate  confirmed  position  unless  DCAA  is  independent  of 
DoD.  Presidential  nomination  and  Senate  confirmation  injects  a  political  element  into 
DCAA  that  is  not  appropriate  and  inevitably  creates  lengthy  perils  when  there  is  no 
Director.  We  also  oppose  fixed  terms  for  the  DCAA  Director.  If  DCAA  remains  part  of 
DoD,  the  Secretary  of  Defense  must  have  the  ability  to  choose  an  appropriate  Director. 
We  also  question  the  wisdom  of  an  independent  budget  (which  would  prevent  or  limit  our 
ability  to  move  money  into  DCAA,  as  is  occurring  now  based  on  funding  from  the 
Defense  Acquisition  Workforce  Development  Fund).  Nor  do  we  support  mandatory 
public  reporting,  an  additional  burden  on  an  agency  that  is  already  struggling  to  meet  its 
many  mission  demands. 

While  we  do  not  support  independence  based  on  the  IG  model,  we  plan  to  take  steps  to 
strengthen  DCAA’s  independence  by  establishing  an  appeals  process  that  permits  DCAA 
to  seek  resolution  when  there  are  differences  of  opinion  as  to  the  resolution  of  its  audit 
findings.  Under  this  process,  DCAA  could  appeal  differences  first  to  the  Director  of 
Defense  Procurement  and  Acquisition  Policy  ^PAP).  If  DCAA  disagreed  with  the 
DPAP  decision,  DCAA  would  be  permitted  to  appeal  to  the  Under  Secretaries  of 
Acquisition,  Technology,  and  Logistics  and  Comptroller,  acting  as  a  team.  We  expect 
that  appeals  at  the  Under  Secretary  level  would  be  rare  tind  would  involve  only  the  most 
important  issues. 

RECOMMENDATION  2:  In  the  medium  term.  Congress  could  consider  elevating  the 
contract  audit  function  within  DOD  by  moving  DCAA  from  under  the  DOD 
Comptroller/CFO  and  placing  it  under  the  Deputy  Secretary  of  Defense. 

DOD  RESPONSE:  Nonconcur.  DoD  strongly  opposes  this  recommendation.  The 
Deputy  Secretary  is  the  Chief  Management  Officer  of  one  of  the  world’s  largest 
organizations  and  backs  up  the  Secretary  in  the  wartime  chain  of  command.  The  Deputy 
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DCAA  Actions  Taken  Since  the  Issuance  of  GAO  Report  GAO-08-857 

Structure 

•  Approved  Agency-wide  reduction  in  supervisory  span  of  control  (June  2008). 

•  Approved  25  new  field  audit  offices  and  5  new  Regional  Audit  Managers  lowering  the 
span  of  control  (May  -  February  2009). 

•  Completed  Agency-tvide  staffing  assessment  and  requested  staffing  increase  to 
Comptroller  on  September  10, 2008.  Updates  on  staffing  shortfalls  were  provided  to  the 
Comptroller  at  regular  intervals  throughout  FY  2009. 

•  Realigned  Quality  Assurance  to  report  directly  to  the  Deputy  Director  (August  2008) 

o  Submitted  request  to  OSD  for  SES  level  position  for  the  Integrity  and  Quality 
Assurance  (QA)  function  (September  2008).  Request  was  initially  denied  by 
D(d>  in  January  2009  and  the  position  was  filled  at  the  GS-1 5  level.  However, 
after  another  attempt  by  the  Director  for  a  SES  position,  DCAA  received  approval 
in  July  2009  and  a  job  announcement  was  issued  shortly  thereafter, 
o  Expanded  the  next  round  of  QA  reviews, 
o  Revised  process  for  trticking  and  following-up  on  QA  findings, 
o  Revised  process  for  next  3-year  cycle  to  ensure  all  audit  offices  are  covered,  after 
consultation  with  the  DoD  IG. 
o  Completed  assessment  on  level  of  QA  staffing. 

o  Issued  revised  comprehensive  instruction  on  DCAA’s  QA  program  (December 
2008). 

•  Submitted  request  for  funds  under  Section  852  acquisition  workforce  fund  in  December 
2008.  Under  the  Defense  Acquisition  Workforce  Development  Fund,  DCAA  has 
received  $172  million  to  date  (allotments  in  March,  April,  and  August), 

o  DCAA  brought  on-board  245  new  interns  by  the  end  of  July  and  have  many  offers 
wilh  on-board  dates  in  late  FY  2009.  As  a  result,  DCAA  will  easily  meet  the  goal 
of 300  by  the  end  of  September  and  will  probably  exceed  it. 

•  Realigned  all  Financial  Liaison  Advisors  firom  the  Field  Detachment  region  (region  that 
handles  all  Top  Secret  audits)  to  Headquarters  to  avoid  the  appearance  of  a  lack  of 
independence.  As  of  November  2008,  all  Financial  Liaison  Advisors  report  directly  to 
Headquarters. 

•  At  the  request  of  the  Director,  the  DCAA  point  of  contact  for  the  Office  of  Special 
Counsel  investigation  was  moved  fiom  the  DCAA  General  Counsel  to  the  DoD  General 
Counsel’s  office  due  to  the  investigation  being  expanded. 

Culture 

•  Revised  policy  for  resolving  differences  in  audit  results  and  opinions  —  elevate  within 
management  structure  from  two  to  four  levels  (July  2008). 

•  Ceased  participation  as  members  of  Integrated  Product  Teams  (IPTs)  to  avoid  the 
appearance  of  a  lack  of  independence  (August  2008). 

•  Revised  performance  measures  -  eliminated  1 8  measures  and  added  8  measures 
(September  2008). 
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•  Established  an  anonymous  website  for  employees  to  voice  concerns  with  the 
inappropriate  use  of  performance  measures  and  other  inappropriate  actions  (September 
2008). 

•  Engaged  0PM  to  conduct  an  organizational  assessment  survey  and  are  assessing  results 
of  the  auvey  conducted  by  0PM  -  the  working  group  is  evaluating  results  and 
developing  actions  (assessment  due  August  2009). 

•  Ceased  participation  as  members  of  Source  Selection  Evaluation  Boards  to  avoid  the 
appearance  of  a  lack  of  independence  -  requested  audits  will  still  be  provided  (November 
2008). 

•  Director/Deputy  Director  staff  presentations  emphasize  the  need  to  perform  quality  audits 
and  discuss  performance  measures  (various  presentations  through  2008  and  2009). 

•  Established  a  Senior  Advisory  Council  for  Improvement  chaired  by  the  Director  to 
oversee  the  implementation  of  improvements  as  a  result  of  the  Defense  Business  Board 
recommendations  (report  issued  January  22, 2009). 

•  Issued  several  memorandums  reiterating  the  importance  of  cooperating  with  GAO,  IG 
and  other  reviewers/investigators. 

•  Held  stand  down  day  for  audit  quality  at  all  DCAA  locations  (August  /September  2008 
and  again  in  August  2009). 

•  Completed  aimual  independence  training  (September  2008). 

•  Held  focus  groups  to  obtain  feedback  on  implementation  of  performance  measures  issued 
in  September  2008  which  revealed  minimal  problems  with  implementation  of  new 
measures  (February/March  2009). 

•  The  Director  required  all  regions  to  assess  whether  exceeding  budget  hours  on  individual 
assignments  was  intqtpropriately  used  to  lower  performance  ratings.  The  regions 
completed  the  assessments  and,  where  needed,  have  implemented  corrective  actions 
(December  2008). 

•  Established  new  process  to  obtain  input  regarding  the  new  hire  employment  experience 
and  to  identify  reasons  why  employees  leave  DCAA  (November  2008). 

•  Revised  job  objectives/performance  plans  for  the  051 1  (auditor)  positions  to  eliminate  the 
language  on  meeting  audit  budget  hours  and  productivity  measures  and  added  language 
strengthening  the  need  to  execute  audits  in  accordance  with  the  auditing  standards  and 
Agency  policy  (February  2009). 

•  Revised  supervisory  development  curriculum  based  on  feedback  from  focus  groups  and 
other  feedback  mechanisms  to  emphasize  leadership  skills  and  the  more  common  day-to- 
day  activities  which  supervisors  perform  (April  2009). 

Processes 

•  Issued  memorandum  on  adequate  working  paper  documentation  (July  2008). 

•  Completed  Agency-wide  assessment  to  determine  whether  GAO’s  findings  are  systemic 
across  DCAA.  Six  of  the  forty  assignments  reviewed  contained  noncompliances. 

Actions  being  taken  to  address  issues  (September  2008). 

•  Raised  the  field  audit  office  signature  authority  for  all  audit  reports  to  the  level  of  the 
manager  or  higher  (August  2008). 
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•  Revised  policy  for  the  monthly  quality  review  of  issued  audit  reports  from  regions  to  the 
Headquarters  Quality  Assurance  division  (October  2008). 

•  Revised  DCAA  Quality  Checklist  for  Review  of  Audit  Working  Papers  (checklist  is  used 
by  auditors  and  supervisors  prior  to  report  issuance)  (December  2008). 

•  Issued  guidance  clarifying  DCAA’s  process  for  pursuing  access  to  contractor  records  and 
initiating  a  subpoena  (December  2008). 

•  Issued  clarifying  guidance  on  what  constitutes  a  significant  deficiency  in  contractor 
internal  control  systems  (December  2008). 

•  Revised  policy  on  reporting  results  of  the  review  of  contractor  systems  and  related 
intemal  controls  to  eliminate  the  inadequate  in-part  opinion  so  that  the  overall  opinion  on 
the  system  is  either  adequate  or  inadequate  (December  2008). 

•  Issued  guidance  on  performing  and  reporting  on  limited  scope  intemal  control  audits 
(December  2008). 

•  Issued  guidance  reminding  auditors  to  report  suspected  contractor  fraud  and  other 
irregularities  encountered  during  the  audit  and  emphasized  that  managers  do  not  approve 
the  Form  2000,  but  rather  review  it  for  clarity  (February  2009). 

•  Issued  guidance  on  documentation  of  ju<%mental  sampling  (February  2009). 

•  Revised  guidance  for  reporting  unsatisfactory  conditions  related  to  actions  of 
Government  officials  wherein  certain  unsatisfactory  conditions  will  be  reported  directly 
to  the  DoDIG  in  lieu  of  reporting  the  conditions  to  a  higher  level  of  management 
(March  2009). 

•  Issued  guidance  clarifying  requirements  for  contractor  eligibility  to  participate  in  the 
direct  bill  program  (April  2009). 

•  Issued  guidance  to  remove  major  contractors  from  direct  billing  where  contractor  has 
implemented  a  new  billing  system  or  accounting  system  that  significantly  impacts 
Government  billings  and  the  new  system  has  not  been  examined  (April  2009). 

•  Revised  a  self-study  training  course  (CMTL  1 326)  to  include  new  guidance  on 
identifying  key  elements  of  an  effective  internal  control  audit  report  and  the  requirements 
for  issuing  a  real-time  (flash)  report  (May  2009). 

•  Issued  an  audit  alert  emphasizing  existii^  guidance  which  requires  that  a  separate  cost 
accounting  standards  (CAS)  noncompliance  audit  report  will  be  issued  when  a  CAS 
noncompliance  is  found  during  any  audit  (June  2009). 

•  Issued  an  audit  alert  to  clarify  that  forward  pricing  due  dates  should  be  based  on  the 
realistic  assessment  of  risk  factors  for  eadi  specific  contractor  and  proposal  under  review 
(June  2009). 

•  Issued  guidance  on  contract  audit  closing  statement  reviews  in  July  (after  receipt  of  DoD 
IG  comments).  This  completes  the  last  action  item  from  the  peer  review. 

Long-Term  Planned  Actions 

•  Obtained  the  services  of  the  Naval  Postgraduate  School,  Center  for  Defense  Management 
Reform  to  assist  with  the  Agency-wide  cultural  transformation.  The  initial  effort  started 
Jtme  2"°  with  the  DCAA  executive  team.  As  a  result,  four  major  initiatives  were  adopted 
for  incorporation  in  the  DCAA  Strategic  Plan.  Teams  of  executives  were  assigned  to 
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each  initiative  to  further  develop  the  milestone  plan  for  executing  the  objective.  The  four 
items  are: 

1 .  How  can  DCAA  put  people  first  to  guide  its  decisions,  actions  and  values?  For 
example,  how  can  DCAA  place  an  increased  emphasis  on  “soft  skills”  such  as 
building  morale  and  developing  employees  (in  terms  of  a  broad  understanding  as  well 
as  technical  proficiency)? 

2.  How  can  DCAA  develop  leaders  to  serve  the  employees  and  the  organization? 

3.  How  can  DCAA  structure  the  organization  to  facilitate  compliance  with  GAGAS, 
maximize  audit  results/ROI,  and  better  align  Agency  workload/resources? 

4.  How  can  DCAA  identify  and  resolve  differing  stakeholder  expectations  with 
contracting  officers,  contractors,  the  public  (Congress),  and  external  review 
organizations? 

These  items  will  be  worked  for  about  the  next  three  years.  Once  the  milestone  plan  for 
each  of  the  four  initiatives  is  developed,  it  is  envisioned  that  each  objective  will  have 
various  completed  actions  throughout  the  next  three  years.  Once  the  milestone  plans  are 
developed,  the  objectives  will  be  communicated  to  the  workforce. 

•  Performing  a  comprehensive  assessment  and  revision  to  DCAA  training  by  instituting  a 
life-cycle  training  process.  Effort  started  in  FY  2008  and  will  conclude  in  about  three 
years. 

•  Conducting  a  comprehensive  organizational  assessment  (based  on  Baldrige).  Estimated 
completion  in  FY  2010. 

•  Performing  a  comprehensive  review  of  DCAA’s  approach  for  performing  internal  control 
audits.  Estimated  completion  of  baseline  audit  opinions  in  FY  2010. 

•  Engaging  the  Army  Force  Management  Support  Agency  to  evaluate  DCAA’s  process  for 
planning  FY  2010  audit  needs  as  well  as  staffing  requirements.  The  effort  is  expected  to 
be  completed  by  the  end  of  September. 
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GAO  DRAFT  REPORT  DATED  JULY  3 1 ,  2009 
GAO-09-468  (GAO  CODE  195099) 


“DCAA  AUDITS:  WIDESPREAD  PROBLEMS  WITH  AUDIT  QUALITY 
REQUIRE  SIGNIFICANT  REFORM” 

DEPARTMENT  OF  DEFENSE  COMMENTS 
TO  THE  GAO  REPORT  NARRATIVE 


L  GAO  NARRATIVE:  Nationwide  audit  quality  problems  are  rooted  in  DCAA’s  poor 
management  environment  (page  11). 

POD  COMMENTS:  GAO  stated  about  half  of  the  rescinded  reports  relate  to  unsupported 
opinions  on  contractor  internal  controls.  This  is  incorrect  The  majority  of  the  rescinded  reports 
relate  to  forward  pricing  reports  based  on  the  prior  GAO  investigation  report  issued  in  2008. 

2.  GAO  NARRATIVE:  Audit  Quality  Problems  Found  in  All  Audits  GAO  Reviewed, 
Independence  Issues  (page  12). 

POD  COMMENTS:  GAO  stated  that  in  8  audits  they  reviewed,  DCAA  independence  was 
compromised  because  auditors  provided  material  nonaudit  services  to  a  contractor  they  later 
audited;  experienced  access  to  records  problems  that  were  not  fully  resolved;  or  significantly 
delayed  report  issuance  in  order  to  allow  the  contractors  to  resolve  cited  deficiencies.  The 
Department  understands  the  GAO’s  concerns,  however,  we  believe  the  auditors’  intent  of 
providing  preliminary  audit  results  and  discussing  draft  policies  and  procedures  was  generally  an 
attempt  to  ensure  the  evidence  was  accurate  and  to  expedite  contractor  actions  so  that  contractor 
systems  would  be  corrected  promptly  to  minimize  the  risk  of  overpayments.  DCAA 
acknowledges  that  significant  time  lapsed  in  several  of  these  assignments  between  the  time  the 
contractor  was  provided  the  draft  findings  and  the  issuance  of  the  final  audit  report.  DCAA 
concurs  that  auditors  should  not  provide  input  to  contractors  on  draft  policies  and  procedures  and 
that  the  reports  should  identify  all  deficiencies  found  even  though  they  have  been  corrected  at  the 
time  of  report  issuance.  In  memorandums  issued  in  August  and  September  2008,  DCAA  issued 
guidance  prohibiting  auditors  from  providing  input  to  contractors  on  such  items  as  draft 
proposals,  draft  policies  and  procedures,  and  dr^  disclosure  statements  and  to  require  auditors 
to  report  all  deficiencies  found  even  when  the  contractor  corrects  the  deficiencies  during  the 
audit. 

3-  GAO  NARRATIVE:  Audit  Quality  Problems  Found  in  All  Audits  GAO  Reviewed, 
Insufficient  Evidence  (page  12). 

POD  COMMENTS:  GAO  stated  that  33  of  the  37  internal  control  audits  did  not  include 
sufficient  testing  to  support  auditor  conclusions  and  opinions.  GAO  stated  that  GAGAS  for 
examination-level  attestation  engagements  require  that  sufficient  evidence  be  obtained  to  provide 
a  reasonable  basis  for  the  conclusion  that  is  expressed  in  the  report.  We  agree  with  GAO  that  in 
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several  cases  the  testing  was  insufficient.  The  level  of  testing  was  based  on  the  auditor’s 
judgment  and  the  total  audit  concept  -  drawing  on  an  accumulation  of  knowledge  and  experience 
previously  gained  at  the  contractor  based  on  auditing  that  contractor  on  a  continual  basis. 
Nevertheless,  DCAA  acknowledges  the  testing  was  insufficient  to  support  an  internal  control 
audit  opinion,  and  therefore,  has  rescinded  several  of  these  reports,  increased  the  level  of  testing 
on  related  audits  and  commenced  new  full  scope  internal  control  audits  at  these  locations. 

4.  GAO  NARRATIVE:  Table  2,  Summary  of  Five  Selected  Internal  Control  Audits,  Eastern 
Region  -  Billing  System  Audit  (page  16). 

POD  COMMENTS:  GAO  stated  that  the  subject  audit  had  an  impairment  to  auditor 
independence  because  the  auditors  helped  the  contractor  develop  policies  and  procedures.  We 
generally  concur  with  the  GAO  in  that  the  FAO  was  performing  IPT  type  effort  in  providing  the 
contractor  comments  on  draft  policies  and  procedures.  DCAA  believes  the  intent  of  these 
actions  was  to  expedite  contractor  corrective  action  so  that  the  contractor’s  system  would  be 
corrected  to  minimize  the  risk  of  overpayments  and  protect  the  taxpayer’s  interests.  DCAA 
recognized  the  potential  appearance  of  a  lack  of  independence  related  to  this  kind  of  effort  and 
on  August  1 1, 2008,  issued  audit  guidance  that  prohibited  auditors  from  providing  input  to 
contractors  on  such  items  as  draft  policies  and  procedures  regardless  of  the  circumstances. 

5.  GAO  NARRATIVE:  Table  2,  Summary  of  Five  Selected  Internal  Control  Audits,  Central 
Region  -  Billing  System  Audit  (page  1 6). 

POD  COMMENTS:  GAO  stated  that  the  subject  audit  had  an  impairment  to  auditor 
independence  because  the  auditors  monitored  contractor  corrective  action  for  7  months  instead  of 
issuing  the  audit  report  when  the  work  was  completed.  DCAA  concurs  with  the  GAO  that  the 
significant  lapse  of  time  from  the  date  the  draft  results  were  provided  to  the  contractor  and  the 
date  the  audit  report  was  issued  gives  the  appearance  of  a  lack  of  independence.  However,  the 
field  audit  office  does  not  believe  it  intentionally  delayed  the  issuance  of  the  report  to  allow  the 
contractor  to  correct  the  system.  Staffing  issues  and  an  increase  in  higher  risk  assignments 
played  a  significant  role  in  the  delay. 

6.  GAO  NARRATIVE:  Table  2,  Summary  of  Five  Selected  Internal  Control  Audits,  Central 
Region  -  Billing  System  Audit  (page  16/17). 

POD  COMMENTS:  The  GAO  narrative  appears  to  imply  that  DCAA  was  not  aggressive  in 
pursuing  the  potential  fraud  at  this  contractor.  It  should  be  noted  that  the  DCAA  Investigative 
Support  Team  was  instrumental  in  assisting  in  this  fraud  investigation  that  resulted  in  recovering 
more  than  $2.8  million  dollars  in  a  civil  case  settlement. 

7.  GAO  NARRATIVE:  Cost  Related  Assignments  (page  17). 

POD  COMMENTS:  GAO  stated  that  the  32  cost-related  assignments  did  not  contain  sufficient 
testing  to  provide  reasonable  assurance  that  overpayments  and  billing  errors  that  might  have 
occurred  were  identified.  It  appears  that  the  GAO  is  holding  DCAA  to  the  GAGAS 
requirements  for  these  assignments  even  though  the  majority  is  not  GAGAS-type  audits  based  on 
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Agency  policy.  DCAA  does  not  agree  that  all  of  the  32  cost-related  assignments  contained 
insufficient  testing,  however,  DCAA  is  continuing  to  assess  the  GAO’s  comments  and  will 
develop  an  appropriate  action  plan. 

8.  GAO  NARRATIVE:  Auditor  objectivity  issues  (page  20). 

POD  COMMENTS:  GAO  stated  that  DCAA’s  role  in  approving  contractors  for  participation  in 
the  direct  bill  program  presented  an  impairment  to  auditor  objectivity-  which  includes  being 
independent  in  fact  and  appearance  when  providing  audit  and  attestation  engagements.  The 
GAO  noted  that  GAGAS  state  that  audit  organizations  should  not  authorize  an  entity’s 
transactions  or  audit  their  own  work.  GAO  further  stated  that  DCAA’s  role  in  authorizing 
contractors  to  participate  in  the  direct  bill  program  places  it  in  the  position  of  making  decisions 
that  impact  its  own  workload  related  to  review  of  contractor  invoices  prior  to  payment. 

Although  not  explicitly  stated,  the  GAO  seems  to  imply  that  when  DCAA  performs  an  audit  of 
the  contractor’s  billing  system  (and  potentially  approves  the  contractor  for  the  direct  bill 
program)  while  also  having  the  responsibility  for  approving  interim  vouchers,  DCAA  is 
authorizing  the  contractor’s  transactions  and  it  is  auditing  its  own  work.  In  addition,  the  GAO 
seems  to  imply  that  DCAA’s  objectivity  is  impaired  and  DCAA  auditors  may  overlook  findings 
to  reduce  their  workload  by  approving  contractors  for  the  direct  bill  program.  DCAA  disagrees 
with  both  implications. 

DCAA  is  not  authorizing  a  contractor’s  transaction  or  auditing  its  own  work  either  when 
it  approves  the  contractor  for  direct  bill  or  approves  an  interim  voucher  for  payment.  GAGAS 
3.14  (GAO-03-673G)  defines  authorizing  an  entity’s  transactions  as  an  example  of  performing 
management  functions  or  making  management  decisions.  When  DCAA  approves  a  contractor’s 
voucher  for  payment  it  is  not  acting  on  behalf  of  the  contractor  (i.e.,  performing  a  contractor 
management  function)  but  acting  as  a  representative  of  the  Government  in  its  role  as  an 
independent  external  oversight  organization  based  on  the  authority  provided  for  in  DFARS 
242.803,  The  contractor’s  interim  vouchers  submitted  to  the  Government  for  payment  are 
prepared  by  contractor  employees  and  authorized  by  contractor  management. 

DCAA  also  does  not  believe  that  performing  the  function  of  an  external  oversight 
organization  by  approving  contractor’s  interim  vouchers  or  approving  the  contractor  for  the 
direct  bill  program  places  DCAA  in  the  position  of  auditing  its  own  work  when  it  later  audits  the 
contractor’s  billing  system.  These  functions  do  not  involve  developing  the  contractor’s  billing 
system  policies  and  procedirres  and  internal  controls.  In  addition,  as  stated  above,  DCAA  also  is 
not  involved  in  preparing  the  contractor’s  vouchers.  Therefore,  approving  contractor’s  interim 
vouchers  or  approving  the  contractor  for  the  direct  bill  program  and  subsequently  auditing  the 
contractor’s  billing  system  does  not  result  in  DCAA  auditing  its  own  work.  Furthermore,  DCAA 
believes  that  its  role  in  reviewing  and  approving  interim  vouchers  falls  within  the  category  of 
nonaudit  services  discussed  in  GAGAS  A3.02  and  A3.03  (GAO-07-73 IG)  that  do  not  impair 
independence. 

We  also  disagree  that  DCAA’s  role  in  authorizing  contractors  to  participate  in  the  direct 
bill  program  results  in  an  impairment  to  independence  because  performing  that  function  places 
DCAA  in  the  position  of  making  decisions  that  impact  its  own  workload.  In  our  opinion  the 
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GAGAS  independence  standards  do  not  preclude  the  auditor  from  performing  such  functions.  In 
fact,  conclusions  reached  in  many  of  the  audits  and  other  functions  typically  performed  by 
auditors  have  the  potential  to  impact  the  audit  organization’s  workload.  For  example,  a  qualified 
or  adverse  opinion  on  the  company’s  financial  statements  could  prompt  the  company  to  replace 
the  independent  public  accountant  (IP A)  that  performed  the  audit;  thereby  negatively  impacting 
the  IPA’s  future  workload  and  revenue.  The  GAO’s  concerns  are  mitigated  by  the  fact  that 
DCAA  supervisors  are  actively  involved  in  all  aspects  of  the  audit  including  review  and  approval 
of  the  risk  assessment,  interim  reviews  as  needed,  and  a  final  comprehensive  supervisory  review 
of  the  working  papers  and  draft  report.  Technical  specialists  may  also  review  the  risk  assessment 
and  audit  conclusion.  In  addition,  field  audit  office  managers  review  sensitive  and  high  risk 
audits  and  may  elevate  them  for  regional  management  review  prior  to  report  issuance. 

GAO  stated  that  DCAA  had  approved  direct  billing  on  all  but  2  of  the  16  contractors  they 
reviewed.  GAO  reviewed  20  billing  system  audits  covering  17  contractors,  only  2  of  those 
contractors  are  still  on  direct  billing.  It  should  also  be  noted  that  since  July  2008,  the  number  of 
contractors  on  the  direct  bill  program  have  been  reduced  by  over  200  contractors. 

9.  GAO  NARRATIVE:  DCAA’s  audit  quality  assurance  program  was  ineffective  (page  25). 

POD  COMMENTS:  GAO  stated  that  DCAA’s  audit  quality  assurance  program  was  not 
properly  implemented,  resulting  in  an  ineffective  quality  control  process  that  accepted  audits 
with  significant  deficiencies  and  noncompliance  with  GAGAS  and  DCAA  policy.  We  do  not 
agree  with  the  statement  that  the  quality  assurance  process  accepted  audits  with  significant 
deficiencies.  As  the  GAO  states  in  its  report,  the  quality  assurance  reviews  did  identify 
significant  GAGAS  noncompliances  which  they  reported  to  the  field  audit  office  for  corrective 
action  -  they  did  not  “accept”  these  audits.  DCAA  has  recently  made  several  improvements  to 
the  quality  assurance  program  to  include  increasing  the  level  of  management  responsible  for 
developing  and  implementing  a  corrective  action  plan.  The  current  program  requires  the 
Regional  Director  to  ensure  corrective  actions  have  been  taken  and  all  corrective  actions  will  be 
tested  by  the  Headquarters  quality  assurance  staff  to  ensure  the  noncompliances  have  been 
corrected. 

10.  GAO  NARRATIVE:  DCAA  lacks  a  risk-based  audit  planning  approach  (page  28). 

POD  COMMENTS:  GAO  stated  that  DCAA  lacks  a  risk-based  audit  plarming  approach.  We 
do  not  agree  with  this  statement.  DCAA  has  a  risk-based  contract  audit  approach  in  identifying 
resource  requirements.  DCAA  performs  annual  audit  requirements  planning  procedures  to 
establish  staffing  requirements  based  on  its  regulatory/statutory  audit  requirements  and  audit 
risk. 

1 1 .  GAO  NARRATIVE:  Allegations  about  abusive  management  actions  have  continued  (page 
32). 

POD  COMMENTS:  The  GAO  states  that  allegations  about  abusive  management  actions  have 
continued.  The  report  further  states  that  “DCAA  Headquarters  officials  explained  that  in  several 
cases.  Western  Region  management  has  not  agreed  to  take  disciplinary  or  other  available 
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corrective  action.  The  officials  told  us  that  DCAA  hotline  staff  has  no  recourse  in  these 
situations.”  The  DCAA  hotline  group  functions  as  a  finder  of  fact,  and  they  recommend 
corrective  actions.  While  it  is  true  that  the  DCAA  hotline  group  has  no  authority  to  take 
disciplinary  action  itself  or  to  require  corrective  action,  any  disagreement  between  the  hotline 
team  and  the  region  may  be  resolved  by  the  DCAA  Director  or  Deputy  Director.  The  Western 
Region  management  has  agreed  with  the  recommended  actions  provided  by  the  hotline  team  in  a 
final  formal  report.  Several  cases  are  still  in  the  investigative  stage  and  although  interim 
recommendations  may  not  have  been  adopted  yet  by  the  region,  we  fully  expect  the  Western 
Region  management  to  support  the  recommendations  made  in  a  final  report. 

12.  GAO  NARRATIVE:  Increase  authority  and  independence  (Page  50). 

POD  COMMENTS:  GAO  stated  that  legislation  could  strengthen  DCAA’s  audit  authority  by 
providing  the  same  level  of  access  to  records  and  persormel  available  to  IGs.  GAO  goes  on  to 
state  that  currently,  DCAA  has  access  to  certain  records  related  to  cost-type  contracts  or  that 
contain  cost  and  pricing  data,  but  not  to  contractor  persormel.  We  do  not  agree  with  the 
statement  that  DCAA  does  not  have  access  to  contractor  personnel.  DCAA  interfaces  with 
contractor  employees  during  all  phases  of  the  audit,  which  include  interviews,  inquiry, 
observation  as  well  as  providing  draft  audit  results  for  comment  and  verification  of  factual 
content. 

13.  GAO  NARRATIVE:  Independence  Impairments,  (Pages  60-61). 

POD  COMMENTS:  The  GAO  provides  an  example  in  this  narrative  section  where  the  GAO 
contends  that  the  field  audit  office  experienced  an  access  to  records  issue.  The  GAO  concludes 
that  since  the  contractor  inquired  regarding  the  auditor’s  need  for  certain  data,  there  was  an 
access  to  records  issue.  DCAA  routinely  encounters  “push  back”  from  contractors,  this  does  not 
constitute  an  access  to  records  impairment  if  the  auditor  does  not  succumb  to  the  pressure  and 
obtains  the  requested  data.  The  field  audit  ofiice  does  not  believe  its  access  to  data  relating  to 
the  training  records  was  denied  by  the  contractor  as  cited  by  the  GAO.  The  contractor 
subsequently  provided  the  requested  data  to  the  auditor. 

14.  GAO  NARRATIVE:  Failure  to  Design  and  Perform  Procedures  to  Detect  Fraud  Risk 
(Pages  64-66). 

POD  COMMENTS:  The  GAO  provides  an  example  in  this  narrative  section  where  the  GAO 
contends  the  FAO  manager  and  supervisor  ordered  an  auditor  to  ignore  significant  fraud  risks 
during  the  audit.  DCAA  does  not  agree  with  this  conclusion  and  has  not  been  provided  evidence 
to  support  this  assertion.  It  should  be  noted  that  the  DCAA  was  instrumental  in  assisting  in  this 
fraud  investigation  that  resulted  in  recovering  more  than  $2.8  million  dollars  in  a  civil  case 
settlement. 
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Defense  Procurement  and  Acquisition  Policy  (DPAP) 

Collateral  Action  Officer’s  Comments  on  GAO  Draft  Report; 

"DCAA  Audits:  Widespread  Problems  With  Audit  Quality  Require  Significant  Reform  " 


Following  are  the  DPAP’s  Collateral  Action  Officer’s  (CAO’s)  technical 
comments  regarding  the  Government  Accountability  Office’s  (GAO’s)  July  31,  2009 
Draft  Report  GAO-09-468  (GAO  Code  195099)  “DCAA  Audits:  Widespread  Problems 
With  Audit  Quality  Require  Significant  Reform”. 

1.  Auditing  in  the  Public  Interest 

The  report,  in  part,  impugns  DCAA’s  audits  stating,  “DCAA’s  management 
environment . . .  put  DCAA  in  the  role  of  facilitating  DoD  contracting  without  also 
protecting  the  public  interest.”'  Likewise,  the  GAO  mentions  that  the  “DCAA  mission 
should  be  refocused  to  protect  the  taxpayer  interest ...”  compared  to  the  current  mission 
that  “fostered  the  culture  of  supporting  contracting  officials  ...”.^  As  a  result,  the  GAO 
agrees  with  the  Defense  Business  Board’s  recommendation  to  “revise  DCAA’s  mission  to 

focus  on  protecting  the  interest  of  taxpayers,  with  the  taxpayer  as  the  primary  customer 

„3 

The  report  adopts  a  position  that  because  DCAA  is  serving  the  interests  of 
Contracting  Officers,  that  DCAA  is  not  auditing  in  the  interest  of  the  public.  DCAA  is  a 
service  organization  created  to  provide  financial  information,  audits,  and  advice  to 
support  decision  making  by  DoD  Contracting  Officers.  DCAA  serves  the  public  interest 
by  providing  timely  and  useful  information  to  Contracting  Officers.  It  is  erroneous  to 
imply  that  contracting  officers  do  not  seek  to  protect  the  public  interest. 

The  contracting  officer  is  bound  by  regulation  to  meet  the  public  interest  in  the 
broadest  sense,  for  the  entire  matter  surrounding  a  contract.  The  contracting  officer,  in 
the  award  and  administration  of  a  contract,  is  the  government  official  responsible  for 
insuring  that  all  requirements  of  law,  executive  orders,  regulations,  and  all  other 
applicable  procedures,  including  clearances  and  approvals,  have  been  met.  Any  logic  that 
presumes  that  by  focusing  on  supporting  contracting  officials  DCAA  somehow  failed  to 
act  in  the  public  interest  is  flawed  in  our  view.  Someone  trained  and  named  in  both  law 
and  regulation  has  to  look  at  the  larger  picture,  and  not  just  the  audit,  if  the  public  interest 
is  to  be  served — the  contracting  officer  is  that  person. 

Numerous  provisions  of  the  Federal  Acquisition  Regulations  (FAR),  for  instance, 
speak  to  the  issue  of  all  members  of  the  acquisition  and  administration  community 
serving  the  public  interest: 


'  Executive  Summary 
^  Page  34 
’  IBID 
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An  essential  consideration  in  every  aspect  of  the  System  is  maintaining  the 
public’s  trust.  Not  only  must  the  System  have  integrity,  but  the  actions  of 
each  member  of  the  Team  must  reflect  integrity,  fairness,  and  openness. 

The  foundation  of  integrity  within  the  System  is  a  competent,  experienced, 
and  well-trained,  professional  workforce.  Accordingly,  each  member  of 
the  Team  is  responsible  and  accountable  for  the  wise  use  of  public 
resources  as  well  as  acting  in  a  manner  which  maintains  the  public 's 
trust.  Fairness  and  openness  require  open  communication  among  team 
members,  internal  and  external  customers,  and  the  public. '' 

Specifically  to  contracting  officers,  FAR  states: 

Contracting  officers  are  responsible  for  ensuring  performance  of  all 
necessary  actions  for  effective  contracting,  ensuring  compliance  with  the 
terms  of  the  contract,  and  safeguarding  the  interests  of  the  United  States  in 
its  contractual  relationships.  In  order  to  perform  these  responsibilities, 
contracting  officers  should  be  allowed  wide  latitude  to  exercise  business 
judgment.  ^ 

By  serving  the  interests  of  Contracting  Officers  well,  DCAA  does  serve  the  public 
interest.  It  is  not  one  or  the  other  as  might  be  interpreted  in  the  report. 

2.  Production  Auditing 

Throughout  the  report,  the  GAO  implies  and  in  some  instances  states  that  the 
problem  is  “Production-Oriented  Auditing”  and  that  audits  have  been  rushed  by 
contracting  officer  requirements.  This  sets  up  a  dichotomy  between  “quality”  audits  and 
timely  audits.  We  strongly  urge  the  GAO  to  consider  that  an  audit  not  delivered  in  time 
to  be  useful,  is  of  limited  value  to  the  Government. 

For  example,  a  proposal  review  delivered  after  negotiation  has  started  and 
decisions  have  already  been  made  is  of  greatly  diminished  usefulness.  Likewise,  an 
incurred  cost  review  that  is  not  completed  in  a  reasonable  period  after  the  costs  are 
incurred  loses  contemporaneous  support — employees  of  the  contractor  and  the 
Government  leave,  some  records  are  lost  or  are  placed  in  deep  storage.  Similarly, 
business  system  reviews  need  to  be  issued  while  a  problem  is  still  subject  to  correction 
before  the  fact  to  protect  the  Government’s  interests,  not  two  and  three  years  later. 

Timeliness  is  a  critical  element  of  quality.  Delays  in  award  have  consequences  to 
the  warfighter.  Contracting  officers  are  required  to  consider  those  consequences  and 
hence,  they  are  very  concerned  that  DCAA  has  not  been  able  to  consistently  deliver 
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timely  reports  and  advice.  The  GAO  has  previously  recognized  there  are  consequences  to 
award  delays:* 

“Although  federal  regulations  do  not  specify  how  long  the  contract  award 
process  should  take,  the  regulations  state  that  the  purpose  of  planning  the 
contract  award  process  is  to  ensure  that  the  government  obtains  the  needed 
goods  or  services  in  the  most  effective,  economical,  and  timely  maimer. 

Therefore,  written  plans  for  carrying  out  the  award  process  must  include 
milestones  for  completing  the  steps  in  the  process,  such  as  when  the  agency 
plans  to  solicit  and  evaluate  proposals  and  make  the  award.  Developing  and 
adhering  to  these  schedules  can  help  ensure  that  the  department  conducts 
the  process  efficiently  and  can  help  companies  make  informed  business 
decisions  regarding  the  allocation  of  their  resources  and  whether  to 
compete  for  a  contract.” 

“Delays  in  awarding  contracts  could  increase  costs. . .  and  could  also  affect 
the  willingness  of  companies  to  compete  for  future... contracts.... 

Specifically,  in  addition  to  investing  time  and  resources  in  developing 
proposals,  once  a  company  submits  a  proposal . .  .the  company  is  generally 
required  to  ensure  that  the  key  personnel  identified  in  the  proposal 
continue  to  be  available  until  the  decision  is  made  and  the  contract 
awarded.  . .  .Increased  costs  and  the  length  of  time  it  takes. .  .to  award  a 
contract  also  have  the  potential  to  affect  competition  for  future. . .  work.” 

GAO’s  recognition  of  this  fact  in  the  aforementioned  report,  while  important,  is 
still  a  comparatively  limited  view  of  timeliness  compared  to  a  contracting  officer’s  point 
of  view,  A  contracting  officer  knows  that  delays  can  impact  funding  decisions  and 
disrupt  program  management  plans.  Contracts  are  often  interrelated  and  codependent, 
such  that  a  delay  in  awarding  one  contract  can  delay  an  entire  system  and  put  off  fielding 
dates,  with  consequences  distributed  and  cascading  through  a  range  of  other  contracts  and 
plans,  and  might  ultimately  result  in  mission  failure.  The  contracting  officer,  also  by 
regulation,  has  to  consider  and  respect  the  opinions  of  other  specialists  that  he  works 
with,  and  not  just  that  of  the  auditor.  A  good  audit  in  time  is  better  than  an  extraordinary 
audit  that  is  late  and  never  used.  An  audit  is  a  tool  the  contracting  officer  uses  to 
negotiate  and  administer  a  contract,  but  in  order  to  realize  the  benefits  of  the  auditor’s 
work,  the  audit  must  be  timely. 

3.  Generally  Aeeepted  Government  Auditing  Standards  (GAGAS) 

As  the  GAO  correctly  points  out,  DCAA  performs  most  of  its  audits  and  reviews 
in  conformance  with  GAGAS,  We  believe  that  for  some  reviews  and  financial  advice 
provided  by  DCAA,  it  is  possible  that  it  may  not  be  necessary  to  provide  a  fully 
conforming  GAGAS  audit  report  to  support  certain  contracting  officer  functions  (e.g., 

‘  GAO-06-722,  DOE  CONTRACTING,  Better  Performance  Measures  and  Management  Needed  to  Address 
Delays  in  Awarding  Contracts,  June  30,  2006 
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See  page  75. 


providing  an  attestation  review  rather  than  a  financial  audit).  DCAA  should  use  auditing 
standards  and  techniques  that  produce  creditable  information  that  can  be  relied  upon  by 
the  contracting  community  in  the  awarding  and  administrating  of  contracts.  However,  we 
believe  that  all  types  of  DCAA  reports  and  reviews  should  be  examined  to  determine  if 
the  standard  being  applied  and  reported  by  DCAA  is  the  appropriate  standard  given  the 
requirement  causing  the  audit  or  review  to  be  performed. 

4.  Staffing 

While  the  report  cites  examples  of  poor  quality  audits  and  some  poor  decisions 
made  by  DCAA  management,  most  would  seem  to  be  heavily  influenced  by  lack  of 
adequate  staffing.  Based  on  our  discussions  with  contracting  officers,  contractors,  and 
auditors,  some  and  possibly  most  of  the  reductions  in  audit  scope  and  responsiveness  by 
DCAA  is  a  direct  result  of  the  staffing  drawdown  while  workload  increased.  Until  the 
staffing  issues  are  resolved,  it  will  not  be  possible  for  DCAA  to  perform  at  the  level  of 
quality  and  efficiency  that  is  desired.  Rebuilding  the  DCAA  workforce,  while  a  challenge, 
can  and  must  be  done.  The  workforce  build-up  will  require  years  of  effort  to  hire  and  train 
the  staff  required  to  do  the  work  envisioned  by  the  GAO  audit. 

5.  Placement  of  DCAA  in  the  Executive  Branch 

The  report  raises  the  question  of  DCAA’s  placement  within  DoD  or  the  Executive 
Branch.  Currently  DCAA  performs  most  of  the  contract  auditing  functions  within  the 
Executive  Branch.  Even  if  DCAA  performed  the  remaining  contract  audits  it  currently  is 
not  performing,  DoD  would  remain  by  a  large  factor  the  majority  user  of  the  DCAA 
services.  We  do  not  believe  that  any  useful  purpose  would  be  served  by  moving  DCAA 
outside  DoD.  DoD  has  the  most  vested  interests  in  a  well  functioning  DCAA. 

In  our  view,  in  reporting  to  the  Comptroller,  DCAA  is  insulated  from  direct 
influence  from  contract  procurement  and  contract  administration  offices.  For  similar 
reasons  DCMA  is  in  the  AT&L  chain  of  command  to  insulate  it  from  pressures  it  might 
have  placed  on  it,  if  it  were  in  the  same  chain  of  command  as  the  procurement  offices. 

The  Comptroller  is  in  the  best  position  to  understand  the  DCAA  requirements  while 
maintaining  its  independence  from  the  audit  report  users. 

6.  Risk  Based  Auditing 

According  to  the  DCAA  Contract  Audit  Manual’,  all  audit  planning  is  risk  based. 
This  applies  to  both  the  aimual  plaiming  for  types  of  audits  and  staff  requirements  as  well 
as  for  the  planning  of  specific  audits.  The  Audit  Manual  is  quite  clear  that  the  final 
budget  set  for  the  assignment  is  to  be  based  on  the  circumstances  and  risk  attached  to  the 
assignment  being  planned.  Further,  it  also  clearly  sets  out  that  as  circumstances  change 
or  the  risk  is  found  to  be  different  than  considered  during  the  planning  stage,  that  budget 
changes  should  be  made. 


’chapter  3,  Section  100 
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We  are  faced  in  the  GAO  report  with  the  finding  that  budgeted  hours  do  not 
reflect  the  risk  and  that  changed  risk  found  during  the  field  work  has  not  resulted  in 
changed  budgets.  This  is  obviously  not  a  policy  matter  of  DCAA  not  doing  risk-based 
auditing,  since  the  findings  are  clearly  at  odds  with  the  DCAA  policy.  We  believe  that 
the  failure  to  follow  the  policy  is  a  result  of  staffing  constraints  that  made  it  impossible 
for  DCAA  to  perform  all  the  assigned  review  requirements  to  the  standards  expected. 

7.  Direct  Billing 

This  GAO  draft  report  seems  to  misunderstand  the  Direct  Billing  program  and  the 
problems  noted  in  DCAA  administration  of  voucher  reviews.  Direct  Billing  approval  was 
not  designed  to  reduce  review  of  vouchers.  It  was  designed  to  administratively  take 
advantage  of  technology  to  better  process  vouchers  in  an  efficient  manner  and  to  better 
comply  with  the  Prompt  Payment  Act.  In  appropriate  circumstances  using  risk-based 
analysis  of  contractor  past  performance  and  the  quality  of  its  business  systems,  contractors 
were  to  be  allowed  to  be  paid  before  review  of  vouchers  instead  of  requiring  review  of  the 
vouchers  before  payment. 

The  nature  of  the  review  program  for  any  given  contractor  should  not  have 
changed  due  to  placement  on  Direct  Billing.  The  DCAA  guidance  requires  voucher 
reviews  of  all  contractors  every  year  that  the  contractor  has  Direct  Billing  authority. 

Where  DCAA  believed  based  on  past  performance  or  poor  systems  that  there  was  a 
significant  chance  of  improper  billing,  the  contractor  was  not  to  be  included  in  the  Direct 
Billing  program.  The  review  program  for  the  contractors  should  have  been  the  same  as  it 
would  have  been  based  on  risk  factors  even  if  there  was  no  Direct  Billing  program. 

The  problem  with  voucher  reviews  both  before  the  Direct  Billing  program  and 
after  the  initiation  of  the  program  is  that  DCAA  did  not  have  sufficient  staff  to  perform 
the  reviews  required  by  the  risk-based  analysis.  New  contractors  and  problem  contractors 
should  have  voucher  reviews  before  payment  just  as  required  by  DCAA  policy. 
Established  contractors  with  adequate  past  performance  should  have  vouchers  reviewed 
after  payment  using  a  reasonable  plan  tailored  to  the  contractor’s  circumstances  just  as 
required  by  DCAA  guidance.  Changing  the  decision  authority  for  participation  in  Direct 
Billing  should  have  no  impact  on  what  vouchers  are  reviewed.  Taking  a  contractor  off  of 
the  program  does  not  ensure  that  the  vouchers  will  be  properly  reviewed  prior  to  payment 
if  there  is  not  sufficient  staff  to  perform  the  reviews. 
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The  following  are  GAO’s  comments  on  the  U.S.  Department  of  Defense 
letter  dated  September  4,  2009. 


GAO  Comments 


1.  Rescinded  reports.  DOD  stated  that  we  were  incorrect  in  stating  that 
about  half  of  the  rescinded  reports  relate  to  unsupported  internal  control 
reports.  DOD  is  correct.  Of  the  80  rescinded  audit  reports,  24  (31  percent) 
relate  to  unsupported  opinions  on  contractor  internal  controls,  47  (61 
percent)  relate  to  forward  pricing  reports,  and  6  (8  percent)  relate  to 
defective  pricing,  compliance  with  cost  accounting  standards,  and  a  labor 
floor  check.  We  have  corrected  this  information  in  the  body  of  our  report. 

2.  Central  Region  billing  system  andit.  DOD  stated  that  the  DCAA  field 
audit  office  does  not  believe  that  it  intentionally  delayed  issuance  of  the 
report  to  allow  the  contractor  to  correct  the  system.  Audit  documentation 
clearly  shows  that  the  auditors  monitored  the  contractor’s  actions  for  7 
months  and  issued  the  audit  report  9  months  after  the  exit  conference, 
once  the  contractor  had  prepared  “written  desk  procedures  to  ensure 
liquidation  progress  billings  would  be  handled  correctly.”  Opinions  should 
be  based  on  the  findings  at  the  end  of  the  audit,  and  reports  should  be 
issued  when  the  audit  is  completed. 

3.  Central  Region  billing  system  andit  dnring  frand  investigation. 

DOD  stated  that  our  report  appears  to  imply  that  DCAA  was  not  aggressive 
in  pursuing  the  potential  fraud  at  this  contractor  and  noted  that  the  DCAA 
Investigative  Support  Team  was  instrumental  in  assisting  in  the  fraud 
investigation  that  recovered  over  $2.8  million  in  a  civil  case  settlement. 

The  audit  documentation  shows  that  the  Regional  Audit  Manager,  in  the 
presence  of  the  field  office  manager  and  the  supervisory  auditor,  directed 
the  auditor  not  to  pursue  contractor  charges  of  costs  to  future-year, 
unfunded  contract  lines  and  to  forget  what  she  learned  in  her  previous 
DOD  contract  administration  job  where  she  had  been  responsible  for 
reviewing  similar  types  of  contracts.  In  addition,  after  reassignment  of  the 
first  supervisor,  the  second  supervisory  auditor  instructed  the  auditor  to 
stop  “over  documenting”  her  audit,  to  complete  the  assignment,  and  issue 
the  report.  Moreover,  the  DCAA  auditors  who  investigated  the  fraud 
worked  with  the  Army  Criminal  Investigative  Division  special  agent  and 
Department  of  Justice  Attorneys,  not  the  DCAA  field  audit  office.  Finally, 
we  did,  in  fact,  discuss  additional  documentation  we  received  from  the 
investigative  auditors  with  DCAA  headquarters  officials  and  provided 
them  a  summary  of  the  key  audit-related  issues  that  we  obtained  from  the 
investigators. 
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4.  Insufficient  testing  in  cost-related  assignments.  DOD  stated  that  it 
appears  that  GAO  is  holding  DCAA  to  the  GAGAS  requirements  for  these 
assignments  even  though  the  majority  of  these  audits  are  not  GAGAS-type 
audits.  As  discussed  in  our  report,  DCAA  does  not  consider  its  paid 
voucher  reviews  and  overpayment  assignments  to  be  GAGAS  assignments. 
However,  this  is  important  work  intended  to  assure  the  reliability  of 
contract  payments.  Specifically,  DCAA  paid  voucher  reviews  are  relied  on 
for  making  billions  of  dollars  in  continuing  contract  payments  without 
prior  review  by  the  government.  The  Defense  Finance  and  Accounting 
Service  (DFAS)  relies  on  DCAA  voucher  reviews,  and  DFAS  certifying 
officers  do  not  repeat  review  procedures  they  believe  were  performed  by 
DCAA.  Because  paid  voucher  reviews  constitute  a  payment  audit,  they 
require  sufficient  testing  to  support  reported  DCAA  conclusions  that  the 
government  can  rely  on  contractor  controls  over  preparation  of  interim 
vouchers  to  continue  to  make  contract  payments  without  prior  review.  In 
addition,  DCAA’s  overpayment  audits  are  intended  to  determine  whether 
the  contractor  has  adequate  controls  in  place  to  detect  and  correct  causes 
of  overpayments  and  billing  errors  and  make  timely  refunds  and 
adjustments.  The  limited  testing  we  observed  in  our  work  does  not 
provide  the  intended  assurance. 

5.  Increase  authority  and  independence.  DOD  stated  that  it  did  not 
agree  with  our  statement  that  DCAA  does  not  have  access  to  contractor 
personnel.  The  discussion  in  our  report  is  based  on  DCAA’s  authority  in  10 
U.S.C.  2313(a)(B)(2),  which  gives  DCAA  legal  access  to  certain  contractor 
records  but  not  access  to  contractor  personnel.  Further,  DCAA  subpoena 
authority  in  10  U.S.C.  2313(b)  is  specific  to  the  production  of  contractor 
records  that  DCAA  is  authorized  to  audit  or  examine  and  does  not  cover 
contractor  personnel.  We  agree  that  in  practice,  DCAA  auditors  have 
numerous  ongoing  discussions  with  contractor  personnel.  However,  if  a 
contractor  official  refuses  to  talk  to  an  auditor,  DCAA  does  not  have  legal 
authority  to  compel  contractor  officials  to  meet  with  or  talk  to  DCAA 
auditors.  Our  point  is  that  under  authority  similar  to  the  IG  Act,  DCAA’s 
authority  to  interview  contractor  officials  would  be  enhanced. 

6.  Independence  impairments.  DOD  stated  that  DCAA  routinely 
encounters  “push  back”  from  contractors  and  that  the  DCAA  field  office 
subsequently  received  training  records  from  the  contractor.  We  recognize 
that  the  field  office  received  some  training  records  from  the  contractor. 
However,  we  saw  a  pattern  throughout  this  audit  where  the  auditor  limited 
requests  for  contractor  documentation  and  also  performed  little  or  no 
testing  in  various  areas  because  “the  contractor  would  not  appreciate  it”  if 
he  did  more  testing.  The  audit  documentation  shows  that  the  auditor 
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performed  limited  testing  of  selected  billing  clerk  training.  Additionally, 
documentation  on  testing  of  the  contractor’s  review  of  subcontractor 
costs  shows  that  although  the  auditor  should  have  tested  cost  data  for 
three  of  the  top  five  subcontractors,  the  auditor  asked  the  contractor  to 
“provide  a  list  of  the  top  3-5  subcontracts,  including  subcontract  values.... 
Three  subcontractors  would  be  fine.”  This  indicates  that  the  auditor  not 
only  accepted  data  the  contractor  was  willing  to  provide  for  testing,  but  he 
also  let  the  contractor  select  the  data  to  be  used  for  testing.  The  auditor 
then  tested  costs  of  only  one  subcontractor.  The  pattern  of  backing  off  on 
requests  for  documentation  and  limiting  the  extent  of  testing  based  on 
concerns  about  the  contractor’s  reaction  indicates  that  the  auditor  was 
influenced  by  the  contractor  and  limited  his  audit  procedures  as  a  result — 
a  clear  independence  impairment.  DCAA  rescinded  the  audit  report  on 
February  10,  2009. 

7.  Production  auditing.  USD  AT&L  comments  suggest  that  there  is  a 
trade-off  between  audit  timeliness  and  audit  quality.  We  view  both  quality 
and  timeliness  as  critical  to  effective  contracting  officer  decision  making. 
However,  timely  audits  that  do  not  meet  professional  standards  are  not 
quality  audits  and  could  be  misleading  or  impair  important  contract 
decisions.  For  example,  our  audit  identified  three  contractor  internal 
control  audits — an  accounting  system  audit  and  two  billing  system 
audits — that  were  completed  in  9,  13,  and  15  days,  respectively — all  with 
adequate  opinions  on  the  contractor’s  internal  controls.  Apparently,  the 
contracting  officers  involved  thought  these  audits  were  timely  and  met 
their  needs  because  there  was  no  audit  documentation  to  the  contrary. 
However,  in  response  to  our  work,  DCAA  has  rescinded  all  three  of  these 
audits.  USD  AT&L  comments  also  stated,  “A  good  audit  in  time  is  better 
than  an  extraordinary  audit  that  is  late  and  never  used.”  Our  report  did  not 
call  for  extraordinary  audits.  DOD  has  determined  that  certain  DCAA 
audits  should  comply  with  professional  standards.  When  audit 
organizations  state  that  their  audits  comply  with  professional  standards, 
they  must  follow  these  standards.  Further,  until  DCAA  and  AT&L  address 
the  need  for  DCAA  to  perform  30,000  assignments  and  issue  over  20,000 
reports  annually,  DCAA  will  continue  to  face  audit  quality  and  timeliness 
problems. 

8.  Contract  audits  in  conformance  with  GAGAS.  USD  AT&L  states 
that  it  believes  that  for  some  reviews  and  financial  advice  provided  by 
DCAA,  it  is  possible  that  it  may  not  be  necessary  to  perform  GAGAS  work 
to  support  certain  contracting  officer  functions.  We  agree.  As  discussed  in 
our  report,  a  risk-based  audit  approach  may  require  an  appropriate 
delegation  of  nonaudit  contract  administration  activities  and  audit 
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responsibilities  among  DCMA,  buying  commands,  finance  community,  and 
DCAA.  An  effective  risk-based  approach  would  include  an  effort  by  these 
communities  to  re-evaluate  whether  all  such  services  should  be  provided 
as  audits  and  whether  DCAA,  as  an  independent  audit  organization,  would 
perform  any  nonaudit  services. 

USD  AT&L  also  stated  that  DCAA  may  be  able  to  support  contracting 
officer  functions  through  an  attestation  review  rather  than  a  financial 
audit.  However,  DCAA  does  not  perform  financial  audits.  Instead,  DCAA 
performs  examination-level  attestation  audits  and  reports  conclusions  and 
opinions  on  subject  matter  as  a  whole.  Examinations  provide  the  highest 
level  of  assurance,  and  they  must  be  based  on  sufficient  evidence,  often 
referred  to  as  positive  assurance  work.  For  an  attestation  review,  GAGAS 
require  auditors  to  perform  sufficient  testing  to  form  a  conclusion  based 
on  the  work  performed.  It  is  important  to  note  that  GAGAS  prohibit 
auditors  from  performing  review-level  attestation  work  for  reporting  on 
internal  control  or  compliance  with  laws  and  regulations. 

9.  DCAA  staffing.  USD  AT&L  stated  that  “the  [DCAA]  workforce  build-up 
will  require  years  of  effort  to  hire  and  train  the  staff  required  to  do  the 
work  envisioned  by  the  GAO  audit.”  We  did  not  call  for  a  build-up  of  the 
DCAA  workforce.  Instead,  we  noted  that  DCAA  production  metrics  had  a 
direct  impact  on  audit  quality.  Therefore,  it  will  be  important  to  perform  a 
risk-based  analysis  of  FAR  requirements  and  determine  the  mix  of  audit 
and  nonaudit  services  that  will  best  meet  these  requirements  with 
consideration  of  appropriate  roles  and  responsibilities  of  the  contracting 
and  finance  communities. 
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INSPECTOR  GENERAL 
DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202-4704 


Gregory  D.  Kutz 
Managing  Director 

Forensic  Audits  and  Special  Investigations 
Government  Accountability  Office 
441  G  Street,  NW 
Washington,  DC  20548 


SEP  3  2009 


Re:  GAO  Draft  Report,  “DCAA  AUDITS:  Widespread  Problems  with  Audit  Quality 
Require  Significant  Reform,”  dated  July  31, 2009  (GAO  Code  195099/GAO-09-468) 

Dear  Mr.  Kutz: 


Thank  you  for  the  opportunity  to  respond  to  the  subject  draft  report.  We  recognize  the 
critical  role  that  the  Defense  Contract  Audit  Agency  (DCAA)  plays  in  contractor  oversight 
inside  and  outside  the  Department  of  Defense,  and  we  take  very  seriously  concerns  about 
compliance  with  generally  accepted  government  auditing  standards  (GAGAS)  by  DoD  audit 
organizations. 


Our  narrative  response  to  your  recommendations  are  included  at  Enclosure  1.  As  an 
alternative  to  the  recommendation  that  this  office  rescind  or  modify  our  May  2007  External 
Review  of  the  DCAA  Quality  Control  System  opinion  report,  we  instead  notified  DCAA  on 
August  24,  2009,  that  our  May  2007  “adequate”  opinion  on  the  DCAA  system  of  quality 
control  would  expire  on  August  26, 2009  (See  Enclosure  2).  On  the  basis  of  our  action, 
DCAA  has  begun  to  qualify  its  GAGAS-compliant  audits  with  a  statement  noting  an 
exception  to  compliance  with  the  Quality  Control  and  Assurance  Standard.  In  addition,  it 
was  recommended  that  DCAA  publicly  disclose  the  concerns  of  your  office  to  include 
questioning  the  reliability  of  audit  reports  issued  during  the  period  covered  by  our  May  2007 
opinion.  Our  August  24,  2009,  memorandum  to  the  DCAA  will  be  made  public  upon  the 
release  of  your  report. 


Please  contact  Ms.  Carolyn  R.  Davis  at  (703)  604-8877  if  you  have  any  questions. 

Sincerely, 


Gordon  S.  Heddell 


Enclosures: 
As  stated 
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GAO  DRAFT  REPORT  DATED  JULY  31,  2009 
GAO-09-468  (GAO  CODE  195099) 


“DCAA  AUDITS;  WIDESPREAD  PROBLEMS  WITH  AUDIT  QUALITY  REQUIRE 

SIGNIFICANT  REFORM” 

DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL  COMMENTS 
TO  THE  GAO  RECOMMENDATIONS 


RECOMMENDATION  1:  The  GAO  recommends  that  the  Department  of  Defense 
Inspector  General  (DoD  IG)  reconsider  its  overall  conclusions  in  the  May  2007  DoD  IG 
report  on  the  audit  of  DCAA’ s  quality  control  system  in  which  it  reported  an  adequate 
(“clean”)  opinion  on  DCAA  system  of  quality  control  in  light  of  the  serious  deficiencies 
and  findings  included  in  that  report  and  the  additional  evidence  identified  in  our  audit. 
(Page  57/GAO  Draft  Report) 

DODIG  RESPONSE:  Concur. 

RECOMMENDATION  2:  The  GAO  recommends  that  the  Department  of  Defense 
Inspector  General  based  on  the  above,  determine  whether  the  report  should  be  rescinded 
or  modified.  (Page  57/GAO  Draft  Report) 

DODIG  RESPONSE:  Nonconcur.  In  reference  to  your  recommendation  that  wc 
rescind  or  modify  our  May  2007  External  Review  of  the  DCAA  Quality  Contiol  System 
opinion  report,  we  have  taken  an  alternative  action  that  confprms  to  the  intent  of  your 
recommendations.  The  DoD  IG  has  taken  the  extraordinary  action  of  notifying  DCAA 
that  our  “adequate”  opinion  on  DCAA’s  system  of  quality  control  as  detailed  in  the 
May  2007  External  Review  of  the  Defense  Contract  Audit  Agency  (DCAA)  Quality 
Control  System  report  will  expire  as  of  August  26,  2009  (See  Enclosure  2). 

Our  action  recognizes  that  our  May  2007  report  was  based  upon  a  quality  review 
methodology  that  differed  substantially  from  your  audit,  but  acknowledges  that  additional 
concerns  about  DCAA  quality  controls  must  be  addressed.  On  August  5, 2009,  we 
announced  a  project  under  the  title  “Evaluation  of  the  Defense  Contract  Audit  Agency 
Quality  Assurance  Program”  (Project  No.  D2009-DIP0AC-0283).  The  results  of  this 
evaluation  will  be  used  in  formulating  our  next  opinion  on  the  DCAA  external  quality 
control  system  for  the  period  ending  September  30, 2009.  The  overall  opinion  will  take 


Enclosure  1 
Page  1  of 2 
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into  consideration  repeated  non-compliances  with  Government  Auditing  Standards 
identified  in  our  May  2007  and  December  2003  opinion  reports  on  the  DCAA  quality 
control  system.  By  not  rescinding  our  May  2007  report,  we  can  also  use  the  repeat 
deficiencies  in  formulating  our  next  opinion. 

Placing  an  expiration  date  on  the  opinion  means  that  after  August  26,  2009,  DCAA 
will  be  operating  without  an  opinion  on  its  system  of  quality  control.  We  have 
recommended  to  the  Director,  DCAA,  that  her  agency  immediately  begin  to  qualify  its 
GAGAS-compliant  audits  with  a  modified  GAGAS  statement  noting  an  exception  to 
compliance  with  the  Quality  Control  and  Assurance  Standard.  Additionally,  we  have 
recommended  that  DCAA  publicly  disclose  on  its  official  website  your  concerns, 
including  the  questioning  of  the  reliability  of  audit  reports  issued  during  the  period 
covered  by  this  office’s  May  2007  opinion. 

Our  May  2007  report  and  the  GAO  July  2009  draft  report  focused  on  the  period 
ended  September  30,  2006.  I  believe  it  is  paramount  that  wc  move  forward  and  critically 
analyze  the  existing  DCAA  environment,  its  organizational  effectiveness,  and  the  quality 
of  its  recent  audit  work.  Given  the  critical  mission  of  DCAA,  we  plan  to  focus  our 
attention  and  resources  on  a  current  analysis  to  yield  real-time  effective  recommendations 
to  improve  DCAA  audit  quality. 


Enclosure  1 
Page  2  of  2 
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INSPECTOR  GENERAL 
DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202-4704 


AUG  2  4  2009 


MEMORANDUM  FOR  DIRECTOR,  DEFENSE  CONTRACT  AUDIT  AGENCY 

SUBJECT:  Review  of  the  Defense  Contract  Audit  Agency  Quality  Controf  System  (OIG 
Report  No.  D-2007-6-006)  and  GAO  Draft  Report,  “DCAA  Audits: 
Widespread  Problems  with  Audit  Quality  Require  Significant  Reform” 
(GAO-09-468) 

Our  May  2007  External  Review  of  the  Defense  Contract  Audit  Agency  (DCAA) 
Quality  Control  System  provided  DCAA  with  an  adequate  opinion  on  its  internal  quality 
control  system  while  still  identifying  significant  audit  quality  problems.  However,  our 
significant  findings  in  2007  coupled  with  the  results  of  the  July  2009  Government 
Accountability  Office  (GAO)  draft  report,  “DCAA  Audits:  Widespread  Problems  with 
Audit  Quality  Require  Significant  Reform”  (GAO-09-468),  necessitates  that  we  take 
further  action.  We  have  determined  that  it  is  not  prudent  to  allow  the  adequate  opinion 
from  our  May  2007  report  to  carry  forward.  Therefore,  effective  August  26, 2009,  our 
adequate  opinion  will  no  longer  apply  to  the  DCAA  system  of  qualify  control  and  will 
require  fin  ther  actions  on  your  part.  Specifically,  we  recommend  the  following  be 
implemented  immediately: 

1 .  After  August  26,  2009,  all  DCAA  audits  identified  as  being  in  compliance  with 
generally  accepted  government  auditing  standards  (GAGAS)  must  be  qualified 
with  a  modified  GAGAS  statement  noting  an  exception  to  compliance  with  the 
Quality  Control  and  Assurance  standard. 

2.  DCAA  should  publicly  disclose  on  the  DCAA  website  GAO’s  concerns  regarding 
the  reliability  of  DCAA  audit  reports  issued  during  the  period  covered  by  this 
office’s  May  2007  opinion. 

As  requested  by  yom-  July  30, 2009,  letter  to  my  office,  we  have  started  preparing 
for  the  external  quality  control  review  (“peer  review”)  of  DCAA  for  the  period  ending 
September  30,  2009.  On  August  5,  2009,  we  announced  that  project  under  the  title 
“Evaluation  of  the  Defense  Contract  Audit  Agency  Quality  Assurance  Program”  (Project 
No.  D2009-DIPOAC-0283.000).  The  results  of  this  evaluation  will  be  used  in 
formulating  our  overall  opinion  of  the  DCAA  quality  control  system.  The  overall 
opinion  will  also  take  into  consideration  repeated  non-compliances  with  Government 
Auditing  Standards  identified  in  our  May  2007  and  December  2003  opinion  repoifs  on 
the  DCAA  quality  control  system. 


Enclosure  2 
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This  action  is  necessary  to  maintain  the  integrity  of  this  office’s  oversight 
responsibilities  for  audits  conducted  by  Department  of  Defense  agencies.  This 
memorandum  is  being  distributed  to  the  recipients  of  our  May  1,  2007,  opinion  report, 
and  will  be  posted  with  the  May  2007  opinion  report  on  our  DoDIG  website. 

Please  contact  me  or  Mr.  Charles  W.  Beardall  at  (703)  602-1017  or 
Ms.  Carolyn  R.  Davis  at  (703)  604-8877  if  you  have  any  questions. 


(pohSi.friA.'S. 

Gordon  S.  Heddell 


cc:  Under  Secretary  of  Defense 

(Comptroller)/Chief  Financial  Officer 


Enclosure  2 


(195099) 
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GAO’S  Mission 

The  Government  Accountability  Office,  the  audit,  evaluation,  and 
investigative  arm  of  Congress,  exists  to  support  Congress  in  meeting  its 
constitutional  responsibilities  and  to  help  improve  the  performance  and 
accoimtability  of  the  federal  government  for  the  American  people.  GAO 
examines  the  use  of  public  funds;  evaluates  federal  programs  and  policies; 
and  provides  analyses,  recommendations,  and  other  assistance  to  help 
Congress  make  informed  oversight,  policy,  and  funding  decisions.  GAO’s 
commitment  to  good  government  is  reflected  in  its  core  values  of 
accountability,  integrity,  and  reliability. 

Obtaining  Copies  of 
GAO  Reports  and 
Testimony 

The  fastest  and  easiest  way  to  obtain  copies  of  GAO  documents  at  no  cost 
is  through  GAO’s  Web  site  (www.gao.gov).  Each  weekday  afternoon,  GAO 
posts  on  its  Web  site  newly  released  reports,  testimony,  and 
correspondence.  To  have  GAO  e-mail  you  a  list  of  newly  posted  products, 
go  to  www.gao.gov  and  select  “E-mail  Updates.” 

Order  by  Phone 

The  price  of  each  GAO  publication  reflects  GAO’s  actual  cost  of 
production  and  distribution  and  depends  on  the  number  of  pages  in  the 
publication  and  whether  the  publication  is  printed  in  color  or  black  and 
white.  Pricing  and  ordering  irrformation  is  posted  on  GAO’s  Web  site, 
http://www.gao.gov/ordering.htm. 

Place  orders  by  calling  (202)  512-6000,  toll  free  (866)  801-7077,  or 

TDD  (202)  512-2537. 

Orders  may  be  paid  for  using  American  Express,  Discover  Card, 

MasterCard,  Visa,  check,  or  money  order.  Call  for  additional  information. 

To  Report  Fraud, 
Waste,  and  Abuse  in 
Federal  Programs 

Contact: 

Web  site:  www.gao.gov/fraudnet/fraudnet.htm 

E-mail:  fraudnet@gao.gov 

Automated  answering  system:  (800)  424-5454  or  (202)  512-7470 

Congressional 

Relations 

Ralph  Dawn,  Managing  Director,  dawnr@gao.gov,  (202)  512-4400 

U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7125 
Washington,  DC  20548 

Public  Affairs 


Chuck  Young,  Managing  Director,  youngcl@gao.gov,  (202)  512-4800 
U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7149 
Washington,  DC  20548 
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